How do I “unlock” sudo for 15 mins after login?

Question

It doesn't make sense to me that after authorising myself by logging in, I then have to separately authorise myself to sudo, potentially typing the password twice. This has all come to a head recently when I have been logging in from my android phone where it takes 10 or 15 seconds to type the password in on the touchscreen instead of 2 seconds on my keyboard!

So I would ideally like to configure sudo such that after authorising myself (whether via a console login, an ssh password login or an ssh key login) sudo is unlocked for 15 minutes, as if I had typed a password for the sudo command.

So this would maintain the security benefits of automatically locking sudo if I left a console open, but giving some convenience.

I suppose the disadvantages are that I unlock sudo on every login regardless of whether I want to use sudo, and allowing sudo for ssh key logins could allow someone who compromised a private key to use sudo despite not knowing the password, which would I suppose delegate the security of the machine to the security of the private key. So a loss of a private key would transfer from a remote access vulnerability to a remote root access vulnerability...

But still, it would be quite convenient!

Answer 1

Could be done by having pam_exec run a command that creates the necessary timestamps in /var/lib/sudo.

Append the following to /etc/pam.d/sshd and/or /etc/pam.d/login (but not common-session or anything like that):

session optional pam_exec.so /usr/lib/sudo-auth

The script could be:

#!/bin/sh

# Depends on your distro. May be /var/db/sudo, /var/spool/sudo, etc.
root="/var/lib/sudo"

if [ "$PAM_USER" ]; then
    dir="$root/$PAM_USER/"
    if [ "$PAM_TYPE" = open_session ]; then
        mkdir -p "$dir" && touch "$dir"
    fi
else
    echo "Must be run from PAM." >&2
fi

Requires the tty_tickets option to be disabled in sudoers, due to the way SSH (and opensshd in particular) work with ttys.

This could be modified to only authenticate specified remote hosts, either by putting pam_access above pam_exec in the PAM stack, or by just comparing $PAM_RHOST in the script. (Such checks wouldn't work with mobile clients, however.)

Answer 2

ref: ubuntuforums.org

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd
again. The default is 5. Set this to 0 to always prompt for a
password. If set to a value less than 0 the user's timestamp will
never expire. This can be used to allow users to create or delete
their own timestamps via sudo -v and sudo -k respectively.

Edit the file:

sudo visudo

To the defaults line, add :

timestamp_timeout=15

So it looks simular to this :

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults env_reset,timestamp_timeout=15