5

Is there a command to de-elevate the user from sudo permissions after I execute a command such as sudo pmset sleep 0 so that when I try to execute another sudo command it asks for my password again?

Currently after one sudo command it will execute any others without asking for my password. The command exit doesn't seem to work.

2 Answers 2

7

sudo -k will do what you want; it invalidates the sudo timestamp, effectively revoking your sudo permissions so that you will be prompted for a password again next time you use sudo.

sudo doesn't (by default at least) open another terminal, so exit won't help; it will just quit the shell you were already using.

Source.

3
  • 2
    I think exit to quit the terminal works for me on Linux, in the sense that sudo's cache is restricted to a single pseudo-tty, and the cache is somehow cleared when the pty is closed.
    – sourcejedi
    Feb 19, 2013 at 21:35
  • 2
    @sourcejedi, it works, but it also has the side effect of quitting the terminal! Which I think is more than the OP was asking for. Feb 19, 2013 at 21:37
  • Exactly what I had in mind, thanks. Sorry it took me 3+ years to select the best answer :/ Oct 27, 2016 at 23:48
1

You should also be able to do this (at least you can on Linux, it may be different on OSX) by setting the timestamp_timeout to 0 in /etc/sudoers. This is the time for which the password is remembered . On most Linux distributions, the default is set at 15 minutes. Setting it to 0 means that sudo will prompt for a password every time it is run. To change it do the following:

  • Run sudo visudo, this will open a vim session allowing you to edit /etc/sudoers.

  • Hit i to enter INSERT mode

  • Add this line

    Defaults        timestamp_timeout=0
    
  • Hit Esc to exit INSERT mode

  • Hit :wqEnter to save the file and exit.

Now, sudo will always ask for a password, even if you have just given it one. If you think this is too strict, you can use a higher value, say 5 for five minutes or 0.5 for 30 seconds.


2
  • To be clear; this will permanently (with a value of 0) remove the ability of sudo to remember the password, rather than clear the memory in one instance only. I'm not sure if that's what the OP wanted. Feb 19, 2013 at 22:36
  • @AndrewFerrier it is up to the OP to choose a rational value for their user case. I mention that they can set it to 5mins or 30secs as well.
    – terdon
    Feb 19, 2013 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .