Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
When I run sudo as a normal unprivileged user, it asks for my password, not the root password. That's often convenient, but it reduces the amount of information someone would have to have in order to run commands as root. So how can I make sudo ask for the root password instead of the invoking user's password?
I know it'd be done with a line in /etc/sudoers, but I can never seem to properly parse the BNF grammar in the man page to figure out exactly what to write.
Ok, here it is again so you can set the checkmark.
In /etc/sudoers, add this line:
Defaults rootpw
to turn on the rootpw flag, making sudo ask for the root password.
visudo command instead of manually editing the /etc/sudoers file. visudo validates the file to make sure it's correct before saving, so you don't get locked out of sudo if you make a syntax error... askubuntu.com/a/81054/166411
Nov 26, 2013 at 21:22
You need to turn the rootpw flag on.
I know this question is old, but it is the most concise question I've found for this use case (which is a minor percentage, true, but nonetheless legitimate and helpful in the right scenario).
After putting all the steps together from various sources - including multiple answers to this question, these steps work on Ubuntu-Gnome 16.04 LTS:
sudo passwdsudo visudoDefaults rootpwJust a quick note - I also wanted to make sure that the root user couldn't be used to login from the graphical login, and so was looking into ways to excluded. Apparently, the root user is excluded by default, and cannot be used to login through the Gnome graphical login - which is a very good thing!
root ALL=(ALL) ALL Defaults targetpw ALL ALL=(ALL) ALL Allows root sudo for every user that knows the root password. Naively changing the last two lines to your solution Defaults rootpw causes a lockout from sudo. You also need to add your user to sudoers like so: myusername ALL=(ALL) ALL or give similar privileges to a group and then add myusername to that group.
Apr 5, 2019 at 4:12
A common configuration that requires the password of the target (not what we want):
Defaults targetpw
ALL ALL=(ALL) ALL
The second line would read out loud like:
"ALL users on ALL hosts can impersonate (ALL) users when executing ALL commands."
and the Defaults targetpw means that they need to know the password of the user they are impersonating to do so.
Naively changing this simple config to:
Defaults rootpw
wouldn't leave any user or group with the privilege to run commands as another user.
One working possibility would be:
Defaults rootpw
myuser ALL=(ALL) ALL
In plain English, myuser now has the ability to run ALL commands as any user on ALL hosts, so long as the root password is known.
Another working possibility would be:
Defaults rootpw
%sudousers ALL=(ALL) ALL
Any member of the sudousers group will have the ability to run ALL commands as any user on ALL hosts, so long as the root password is known. To allow myuser to run sudo commands, sudousers would need to be added to its secondary groups.
su
usermod -a -G sudousers myuser
exit
EDIT: A clarifying example about exceptions and scope:
Defaults rootpw
myuser ALL=(ALL) ALL
%sudousers ALL=(ALL) ALL
Defaults:%sudousers !rootpw
This requires myuser to know the root password, but requires any member of the sudousers group to use their own password. Note that if myuser is a member of sudousers then this behaviour overrides rootpw for them too (last matching entry overrides previous entries).
You could just turn off sudo and use su -c.
Using
sudo su
will let you run as many commands as you want in succession.
sudo to prompt for the root password, this would still allow someone to gain root access by presenting only one password (not root's). So it doesn't really address the security concern that prompted my question.