0

I use sudo on my linux workstation, and it is configured to request a password each time.

But typing the password every time is cumbersome and also a bit dangerous if I don't have the focus to the right window.

I'd like to configure sudo to have the following behaviour:

  • If headless (no X11), request full password
  • If X11 is available prompt for confirmation, the confirmation should be a gui window with an allow and deny button and some simple input (like type yes to confirm, to prevent hitting enter accidentally)
  • I did not mention it, but if you have an idea that use some hardware (like fingerprint reader), that would work too. In the end I just want to grant sudo rapidly. – Nicolas Goy Jan 12 at 1:22
1

It's technically possible with sudo -A. From man 8 sudo:

-A
Normally, if sudo requires a password, it will read it from the user's terminal. If the -A (askpass) option is specified, a (possibly graphical) helper program is executed to read the user's password and output the password to the standard output. If the SUDO_ASKPASS environment variable is set, it specifies the path to the helper program. […]

Your solution may look like this:

  1. Write a helper script. The script should check if X11 is available.

    • If it is, the script should display a window you desire. If you allow, the script will read your password from a file and print to standard output (cat file may be enough).
    • If X11 is not available, the script should use stdin (e.g. read -rs in Bash) to get the password from you; then print it to standard output.

    Securing the file (so nobody else can read it) and the script (so nobody else can change it) is your concern now.

  2. Set SUDO_ASKPASS="/path/to/your/helper/script" and export it.

  3. Define an alias alias sudo='sudo -A'.

Note the answer only states this is technically possible. It doesn't say this is secure or recommended.

  • Well, the idea is that even my user shouldn't be able to escalate to root without graphical confirmation. With this setup, the password file would be readable by my user. – Nicolas Goy Jan 12 at 1:21
  • @NicolasGoy I don't follow. You know your password in the first place, so what difference does the readable file make? – Kamil Maciorowski Jan 12 at 1:28
  • Because if I run a malicious script it could read the file and run as root without me knowing. But well, that's very unlikely as it would have to know in which file I store my password. I'm against security through obscurity, but I guess it wouldn't be a problem in this case. – Nicolas Goy Jan 12 at 2:06
0

This is generally more dangerous as this makes local privilege escalation very easy. Perhaps you can achieve close to intended results by compiling polkit with a timeout which suits your needs? https://unix.stackexchange.com/questions/409636/pkexec-how-do-i-set-a-custom-timeout-for-auth-admin-keep-when-writting-a-pkexe

  • Welcome to Super User! Can you edit your answer to include the relevant information from the link, by way of explanation? Thanks – bertieb Jan 11 at 16:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.