4

Ok, here's my problem - Please don't yell at me for being insecure! :) This is on my host machine. I'm the only one using it so it's fairly safe, but I have a very complex password that is hard to type over and over. I use the console for moving files around and executing arbitrary commands a LOT, and I switch terminals, so sudo remembering for the console isn't enough (AND I still have to type in my terrible password at least once!) In the past I have used the NOPASSWD trick in sudoers but I've decided to be more secure. Is there any sort of compromise besides allowing no password access to certain apps? (which can still be insecure) Something that will stop malware and remote logins from sudo rm -rf /-ing me, but in my terminals I can type happily away? Can I have this per terminal, perhaps, so just random commands won't make it through? I've tried running the terminal emulations as sudo, but that puts me as root.

3
  • 8
    This will get me flamed (so is a comment): If no one has physical access to your computer, you do not need a password. If anyone has physical access to your computer, he doesn't need a password to boot from CD and take control. A password is only useful against casual passers-by, not against anyone with some (little) knowledge and time.
    – harrymc
    Nov 22, 2010 at 11:25
  • @harrymc: true, physical access will always be the weak point where physical access is possible. Unless the filesystems are encrypted, and the keys not stored insecurely, of course. Dec 8, 2010 at 23:28
  • @harrymc: You're aware that then you're basically working as privileged user/root all the time, and that's one of the reasons why there are so many botnets for rent? Or did I misunderstand you?
    – Bobby
    Jan 12, 2011 at 21:15

5 Answers 5

9

Try adding this to your sudo options:

Defaults timestamp_timeout=0, tty_tickets

tty_tickets option (on by default) will make sudo ask password if it was not asked previously in that particular tty (including terminal emulators ptys), and timestamp_timeout=0 option will make it not ask it again in the whole session.

So, when you want to do some administrative operations, you can open terminal, sudo something, close it, and you will be safe again.

4

The most secure alternative to using no password is to use an alternative authentication method via PAM. You could, for instance, use a smartcard reader. You'd simply insert the card before using 'sudo', and remove it when done. There is even a PAM module for voice authentication. If you can't find a PAM module that you like and you're not comfortable with C, there are Python bindings.

Check out this list of PAM modules.

2
  • Very cool, had not heard of this!
    – V_H
    Jun 19, 2011 at 1:02
  • One of those alternatives is using a fingerprint reader. You still have a strong password on login, but once logged in, use the FP reader to sudo.
    – alci
    Dec 14, 2013 at 12:06
1

Set rootpw on your /etc/sudoers:

 Defaults        rootpw

Give root a simpler password than yours.

Remember to forbid root on ssh, in case you have installed an ssh server.

If your horrible password is to protect your files, then they are really protected only if they are encrypted, otherwise this is just "security theater". Assuming this is why you wanto to keep the big one, you will be safe: breaking root's password still won't be enough to decrypt your files, and any kind of malware will fry our CPU before guessing the password.

1

A different approach to /etc/sudoers and such would be sudo -i and staying root. For example, if you use GNU screen, you can have one window as regular user and a second, where you issue sudo -i and stay root.

If your ~/.screenrc looks like this, issuing screen automatically opens you two "tabs" accordingly:

hardstatus alwayslastline "%w"
screen -t normal
screen -t root sudo -i
1

in /etc/sudoers (visudo) add a line like this:

uberjim ALL = (ALL) NOPASSWD:ALL

then as your user, once logged in (with your secure password) you can just type:

sudo /cmd/you/want/to/run

No password required :) Have fun

1
  • 3
    replacing uberjim with his own username, naturally
    – Journeyman Geek
    Mar 27, 2011 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .