Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I run sudo as a normal unprivileged user, it asks for my password, not the root password. That's often convenient, but it reduces the amount of information someone would have to have in order to run commands as root. So how can I make sudo ask for the root password instead of the invoking user's password?

I know it'd be done with a line in /etc/sudoers, but I can never seem to properly parse the BNF grammar in the man page to figure out exactly what to write.

share|improve this question
    
I recommend you restrict the commands that are permissible as the non-root user so that you need not worry about exposing arbitrary commands. –  Slartibartfast Jul 9 '10 at 5:02
    
@slartibartfast: but then what happens when I need to run a command as root that is not in the preapproved list? –  David Z Jul 9 '10 at 5:46
2  
+1 for the obnoxious BNF in the sudoers man page –  Brian Jul 9 '10 at 15:19
add comment

4 Answers

up vote 7 down vote accepted

Ok, here it is again so you can set the checkmark.

In /etc/sudoers, add this line:

Defaults rootpw

to turn on the rootpw flag, making sudo ask for the root password.

share|improve this answer
1  
You should always use the visudo command instead of manually editing the /etc/sudoers file. visudo validates the file to make sure it's correct before saving, so you don't get locked out of sudo if you make a syntax error... askubuntu.com/a/81054/166411 –  Colin D Bennett Nov 26 '13 at 21:22
add comment

Using

sudo su

will let you run as many commands as you want in succession.

share|improve this answer
    
Good idea, but unless I change sudo to prompt for the root password, this would still allow someone to gain root access by presenting only one password (not root's). So it doesn't really address the security concern that prompted my question. –  David Z Jul 9 '10 at 20:14
    
Instead of using sudo's capacity to limit access by user you are exposing your root password to a number of users. You are also removing the capability of securing your server by removing the password from root. –  BillThor Jul 10 '10 at 2:53
add comment

You could just turn off sudo and use su -c.

share|improve this answer
    
Inconvenient because I have to enter my password every time I run it. The use case here is having to run multiple commands as root in quick succession. –  David Z Jul 9 '10 at 5:45
add comment

You need to turn the rootpw flag on.

share|improve this answer
    
As I said, I haven't been able to work through the BNF notation in the man page - so what line would I insert into /etc/sudoers to enable this flag? –  David Z Jul 9 '10 at 5:48
2  
Defaults rootpw –  Florian Diesch Jul 9 '10 at 9:57
    
@Florian: whaddya know, it's that easy :-) If you post that as an answer you get the checkmark. –  David Z Jul 9 '10 at 20:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.