Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It doesn't make sense to me that after authorising myself by logging in, I then have to separately authorise myself to sudo, potentially typing the password twice. This has all come to a head recently when I have been logging in from my android phone where it takes 10 or 15 seconds to type the password in on the touchscreen instead of 2 seconds on my keyboard!

So I would ideally like to configure sudo such that after authorising myself (whether via a console login, an ssh password login or an ssh key login) sudo is unlocked for 15 minutes, as if I had typed a password for the sudo command.

So this would maintain the security benefits of automatically locking sudo if I left a console open, but giving some convenience.

I suppose the disadvantages are that I unlock sudo on every login regardless of whether I want to use sudo, and allowing sudo for ssh key logins could allow someone who compromised a private key to use sudo despite not knowing the password, which would I suppose delegate the security of the machine to the security of the private key. So a loss of a private key would transfer from a remote access vulnerability to a remote root access vulnerability...

But still, it would be quite convenient!

share|improve this question
    
If you need to sudo every time you login, you're doing something wrong. sudo should be kept to computer maintenance tasks, not to daily work / home tasks... –  Tom Wijsman Aug 12 '12 at 14:36
2  
@TomWijsman what if the machine he is logging into is a server that he doesn't use, but only maintains administrates. E.g, when I was a unix admin I administered many of my customers servers. I never visited the websites or used anything on these servers. I only administered them. –  Justin Dearing Aug 12 '12 at 14:41
    
@JustinDearing: In that case sudo would be pointless and he would login as an account he doesn't have to run sudo with. Use the right account / privileges / security / tools for the right job... –  Tom Wijsman Aug 12 '12 at 15:02
    
@Tom Wijsman: allowing remote root logins is considered harmful by some. –  frankster Sep 20 '13 at 14:08

2 Answers 2

Could be done by having pam_exec run a command that creates the necessary timestamps in /var/lib/sudo.

Append the following to /etc/pam.d/sshd and/or /etc/pam.d/login (but not common-session or anything like that):

session optional pam_exec.so /usr/lib/sudo-auth

The script could be:

#!/bin/sh

# Depends on your distro. May be /var/db/sudo, /var/spool/sudo, etc.
root="/var/lib/sudo"

if [ "$PAM_USER" ]; then
    dir="$root/$PAM_USER/"
    if [ "$PAM_TYPE" = open_session ]; then
        mkdir -p "$dir" && touch "$dir"
    fi
else
    echo "Must be run from PAM." >&2
fi

Requires the tty_tickets option to be disabled in sudoers, due to the way SSH (and opensshd in particular) work with ttys.

This could be modified to only authenticate specified remote hosts, either by putting pam_access above pam_exec in the PAM stack, or by just comparing $PAM_RHOST in the script. (Such checks wouldn't work with mobile clients, however.)

share|improve this answer
    
What about the 15 minutes? –  Tom Wijsman Aug 12 '12 at 14:34
    
@TomWijsman The standard timeout set in sudoers applies. –  grawity Aug 12 '12 at 14:42

ref: ubuntuforums.org

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd
again. The default is 5. Set this to 0 to always prompt for a
password. If set to a value less than 0 the user's timestamp will
never expire. This can be used to allow users to create or delete
their own timestamps via sudo -v and sudo -k respectively.

Edit the file:

sudo visudo

To the defaults line, add :

timestamp_timeout=15

So it looks simular to this :

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults env_reset,timestamp_timeout=15 
share|improve this answer
    
the length of the sudo timeout wasn't really the point of the question but thanks for answering :P –  frankster Sep 20 '13 at 14:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.