SOLUTION 1: newgrp
A simple way to address your use case would be to use
:NOPASSWD in combination with a group and group passwd:
Add a line to sudoers:
%rudo ALL=(ALL:ALL) NOPASSWD:ALL
Create a passwd protected group:
gpasswd rudo # Enter passwd
Now when you login as an unprivileged user (assuming your not already in the
rudo group), login to the
rudo group, at which point you'll be prompted for the password.
Now you can run
sudo password-less, so long as you remain logged in to the group.
SOLUTION 2: runaspw
A better, possibly more secure way to do this uses
runaspw is associated with the
runas_default option so you have to add that option too.
Assuming you already have the default
%sudo group entry:
%sudo ALL=(ALL:ALL) ALL
add these lines to sudoers file:
Now add a new
sudo user with a password:
useradd sudo -d /nonexistent -s /usr/sbin/nologin -MNr
Now sudo group users will be prompted for sudo user's passwd but only users in the sudo group will be able to sudo (unlike with the group solution above, where anyone in the group or with the group passwd could sudo).
A minor issue is the default runas user is now
sudo so to sudo as root you need to explicitly specify root:
sudo -u root <cmd>
But easy enough to define an alias (
alias sudo='sudo -u root') or indirect sudo command.