17

Whenever I issue command sudo apt-get install foo it does not ask for password. is it because of user groups?

How to make it prompt for password?

Edit: My sudoers file

apple@Ascension:~$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
9
  • is your user login password blank or auto-login?
    – ish
    May 20, 2012 at 9:42
  • 1
    share your /etc/sudoers please
    – daisy
    May 20, 2012 at 11:24
  • 1
    remove the last 3 lines of sudoers , your problem will be solved.
    – daisy
    May 21, 2012 at 1:05
  • 1
    @warl0ck I didn't edit sudoers then how it get appended in sudoers. Can you explain? BTW it is solved now. May 21, 2012 at 8:04
  • 1
    @virpara the last three lines functions as single one , that will anyone in any machine to launch any commands without password prompting.
    – daisy
    May 22, 2012 at 3:15

1 Answer 1

18

With the command sudo visudo you can see and edit, the sudo configuration, for example :

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Group without password
%nopwd  ALL=NOPASSWD: ALL

Your current user is probably member of a privileged group that enables him to enter sudo commands without password. In this example members of admin and sudo group can issue any command with sudo, but are prompted with a password ; members of the nopwd group are not prompted with a password.

Note that the declaration order is relevant for users belonging to multiple groups. Unintuitively, the LAST matching group wins !

In order to require a password, you can add the PASSWD: /usr/bin/apt-get command specification in file /etc/sudoers ; note that you probably want to allow specific commands with no password, and keep every other command with a password. An example explicitely requesting a password for apt-get:

%users  ALL=NOPASSWD: /sbin/reboot, PASSWD: /usr/bin/apt-get

Note that you can personnalize sudo with a much finer granularity than allow all commands like in my first example (doc ubuntu fr)(doc ubuntu en).

Not the answer you're looking for? Browse other questions tagged .