Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to hack together my own Android app that opens an SSH connection to my computer, and sends commands.

I am aiming to keep the interactivity of this process to a minimum, to make it have the feel of a remote control.

I've added a sudo "switch" that when activated will ask for a sudo password that then will run a command x to be run as sudo -S -p '' x and then the password will be sent to the STDIN.

Problem is if the login fails, the command will then wait for another 2 password attempts, adding interactivity that I don't want!

I know I can edit passwd_tries in the sudoers file, but I rather know if there was a way to set this as an argument with sudo or is it also an enviroment variable that can be set?

Anyone know? Or is this not allowed for security reasons?

share|improve this question
    
Could you just have it check and, if the password failed, just do a couple quick "spam" messages to use up the next two password attempts? Certainly not a very nice solution, but it's an option. –  SaintWacko Sep 10 '12 at 13:27

2 Answers 2

up vote 0 down vote accepted

After browsing through man sudo and sudoers file, I don't see see any way to achieve the wanted behavior.

Possible reasons:
Number of password retries can not be increased, from a security standpoint. While decreasing number of password retries, could be achieved, I guess it wasn't needed.

Possible solution: Using -S, since it fails immediately if password if incorrect:

echo <passwd> | sudo -S ls
share|improve this answer
    
Not quite fails immediately, just sudo takes the same <passwd> for each attempt. But it does do the job! –  user155516 Sep 10 '12 at 17:35

Try setting up a separate user account and configure your sudoers file to grant access without a password at all.

myuser    ALL = NOPASSWD: ALL

Alternatively, set up the user to have a uid of 0 which effectively is a second root account.

This removes any secret password from you Android app. Really, avoid storing shared secrets like user passwords in plain text.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.