10

When I log into an ec2 instance via ssh using keypair (logged in as ec2-user user), I am able to execute sudo commands without typing a password.

How can I configure ec2 instance to prompt for a password when the logged in user issues a sudo command?

Improve this question

1 Answer 1

Reset to default
11

Warning: Make sure to set the password for ec2-user before doing this

You need to modify the sudo settings to enable password authentication when using sudo. Run the visudo command as root (or sudo visudo) and look for a line like this:

ec2-user        ALL=(ALL)       NOPASSWD: ALL

Remove the NOPASSWD: bit, so the line looks like this:

ec2-user        ALL=(ALL)       ALL

sudo will ask for a password next time you log on. Again, make sure to set your password before doing this!

Improve this answer
6
  • 3
    I think that next time you should put 'Make sure to set your password before doing this!' at the very top and in bold.
    – Khanh Tran
    Commented Jul 16, 2014 at 15:12
  • What should I do if I didn't set a password? :)
    – Anton Khodak
    Commented Sep 25, 2017 at 8:36
  • Redeploy the instance using your automated deployment process ;) It's a bit of a workaround, but you can connect the disk of your current container to a different instance as a second disk, mount it and change the /etc/sudoers file. Then unmount and reconnect it to the original instance and boot it.
    – mtak
    Commented Sep 27, 2017 at 8:42
  • yeah this doesn't work.
    – Alexander Kleinhans
    Commented Sep 28, 2017 at 21:11
  • 6
    I'm not sure when this change occurred, but on my EC2 running Amazon Linux 2, the ec2-user entry was in /etc/sudoers.d/90-cloud-init-users
    – cbr
    Commented Nov 27, 2020 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .