Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a command to de-elevate the user from sudo permissions after I execute a command such as sudo pmset sleep 0 so that when I try to execute another sudo command it asks for my password again?

Currently after one sudo command it will execute any others without asking for my password. The command exit doesn't seem to work.

share|improve this question

2 Answers 2

sudo -k will do what you want; it invalidates the sudo timestamp, effectively revoking your sudo permissions so that you will be prompted for a password again next time you use sudo.

sudo doesn't (by default at least) open another terminal, so exit won't help; it will just quit the shell you were already using.

Source.

share|improve this answer
2  
I think exit to quit the terminal works for me on Linux, in the sense that sudo's cache is restricted to a single pseudo-tty, and the cache is somehow cleared when the pty is closed. –  sourcejedi Feb 19 '13 at 21:35
2  
@sourcejedi, it works, but it also has the side effect of quitting the terminal! Which I think is more than the OP was asking for. –  Andrew Ferrier Feb 19 '13 at 21:37

You should also be able to do this (at least you can on Linux, it may be different on OSX) by setting the timestamp_timeout to 0 in /etc/sudoers. This is the time for which the password is remembered . On most Linux distributions, the default is set at 15 minutes. Setting it to 0 means that sudo will prompt for a password every time it is run. To change it do the following:

  • Run sudo visudo, this will open a vim session allowing you to edit /etc/sudoers.

  • Hit i to enter INSERT mode

  • Add this line

    Defaults        timestamp_timeout=0
    
  • Hit Esc to exit INSERT mode

  • Hit :wqEnter to save the file and exit.

Now, sudo will always ask for a password, even if you have just given it one. If you think this is too strict, you can use a higher value, say 5 for five minutes or 0.5 for 30 seconds.


share|improve this answer
    
To be clear; this will permanently (with a value of 0) remove the ability of sudo to remember the password, rather than clear the memory in one instance only. I'm not sure if that's what the OP wanted. –  Andrew Ferrier Feb 19 '13 at 22:36
    
@AndrewFerrier it is up to the OP to choose a rational value for their user case. I mention that they can set it to 5mins or 30secs as well. –  terdon Feb 19 '13 at 22:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.