527

Inspired by this question....

I am the sole person using my system with 12.04.
Every time I issue a sudo command; the system asks for the user password (which is good in its own way).
However I was thinking; without activating the root account; how can I execute the sudo commands which will not ask for user password to authenticate.

NOTE: I want to execute sudo command without authenticating via password; only when they are executed via terminal.
I don't want to remove this extra layer of security from other functions such a while using 'Ubuntu software center' or executing a bash script by drag-drop something.sh file to the terminal.

5
  • 2
    so you only want to be asked for the password in the terminal and for other things not, or the other way arround?! in both ways, I think its a high security breach
    – Dr_Bunsen
    Jun 6, 2012 at 12:33
  • 1
    I want that system may not ask password only when in the terminal... for any other purpose the system must ask a password. This requirement is only temporary, and to be used while configuring n installing new servers.. during fresh server installations, it really take hours of configuring with sudo commands.. issuing password every 15 min. is headache. I don't want to use root account. Jun 6, 2012 at 12:44
  • You need to read the discussion in: askubuntu.com/questions/135428/…
    – david6
    Jun 9, 2012 at 1:18
  • 2
    For sure you can prolong the timeout. Also, if you're frequently doing fresh server setups you should think about automating the process. You are not paid to type, you are paid to solve problems and to get sh*t done.
    – MauganRa
    Oct 12, 2016 at 18:43
  • Related: How to run sudo command with no password? Jul 26, 2017 at 7:12

13 Answers 13

876

You can configure sudo to never ask for your password.

Open a Terminal window and type:

sudo visudo

In the bottom of the file, add the following line:

$USER ALL=(ALL) NOPASSWD: ALL

Where $USER is your username on your system. Save and close the sudoers file (if you haven't changed your default terminal editor (you'll know if you have), press Ctl + x to exit nano and it'll prompt you to save).

As of Ubuntu 19.04, the file should now look something like

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

YOUR_USERNAME_HERE ALL=(ALL) NOPASSWD: ALL

After this you can type sudo <whatever you want> in a Terminal window without being prompted for the password.

This only applies, to using the sudo command in the terminal. You'll still be prompted for your password if you (for example) try to install a package from the software center

gui password prompt

24
  • 22
    It's recommended to use sudo visudo instead of editing it directly. Also changing the permissions of the sudoers may lock yourself out. When editing with vim, use :wq! to write to read-only files and quit the editor. In that way, permissions 644 are not necessary.
    – Lekensteyn
    Jun 6, 2012 at 13:49
  • 15
    This is a serious security risk, anyone taking over any account with sudo rights can take control of the complete system and lock any further access to this computer, seriously not recommended. Sep 12, 2013 at 9:06
  • 11
    @wil93 you are missing the point: a script that calls for sudo install crapware will not ask for a password in this case and might mess up everything you have, and you do not need to be physically next to a machine to distribute scripts last time I checked... This is just an example. Aug 28, 2014 at 12:46
  • 21
    @BrunoPereira If you plan on running untrusted scripts then that is the security risk (even if sudo asks for a password, a malicious script could always do rm -rf ~ messing quite some things up). Overall, I wouldn't call «serious security risk» the simple removal of password prompt from sudo.
    – William
    Aug 29, 2014 at 0:54
  • 9
    Agree with @wil93. When running a untrusted script, inputing password is no more than a chance to cancel the process, while I doubt it's useless for most people. The point is you know where the script from and what it does.
    – Leo
    Sep 4, 2016 at 8:49
104

sudo -i is the way to go if you don't want to be typing a password every 10 mins while doing modifications in your system (or other systems), and you don't want to modify any system files.

It will switch you to root using your sudo user password, when you close the console or type exit you are back to your normal user.

8
  • 3
    Will this hold true that I enter password only once... and till the time I don't exit; weather 5 hrs. or 15.... the system wont ask for authentication by password when any sudo command is issued. Jun 7, 2012 at 21:10
  • 3
    @Z9iT until you type exit or until you close the terminal emulator window. Jun 8, 2012 at 8:33
  • 2
    Thanks.. Accepted this answer because it servers the purpose of issuing sudo commands without password authentication for n-hours till the time we won't exit.. Not modifying system files is a plus. Jun 8, 2012 at 9:58
  • 5
    This doesn't really answer the question, because you still need to enter the password to become root at that point. Jun 2, 2015 at 22:00
  • 2
    Not if you're running a virtual machine in a secured environment and you just want the thing to do something immediately and you do not want to deal with passwords. This answer does not answer the question, while it is arguably helpful information. I agree with Adam F Aug 10, 2016 at 8:34
95

The preferred way to grant individual (or group) permissions would be to add files under /etc/sudoers.d

This separates local changes from the default policy and saves time in case the distribution sudoers file changes.

To make the currently logged in user a a sudoer and make sudo not prompt them for a password, use

echo "$USER ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/$USER

this will create a file called /etc/sudoers.d/$USER (where $USER is the username of the user that you were logged in as when you ran that command), making it clear which users are granted permission.

If you want to do that for a different user, just replace both instances of $USER with some other username in the above command.

echo "otheruser ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/otheruser

Similarly, one file can be used to manage multiple directives:

echo "username ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee -a /etc/sudoers.d/local

See /etc/sudoers.d/README and man sudoers for more information.

7
  • 1
    the echo command failed, even though i'm root. but, I added the file and edited it directly and this worked on latest ubuntu (whereas adding the user to the sudoers directly did not!)
    – scape
    Oct 24, 2017 at 13:43
  • 2
    The right way is to do it with tee command.
    – woto
    Jan 19, 2018 at 8:10
  • 4
    This is a better way that works: sudo sh -c 'echo "$(logname) ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/$(logname)', followed by sudo chmod 440 /etc/sudoers.d/$(logname)
    – paradroid
    Nov 14, 2018 at 16:32
  • 1
    In sudo ... >file shell redirection is executed in the original shell, so it could work only in root shell. Nov 26, 2018 at 13:23
  • 2
    the tee method, without permission issues: echo "username ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/username
    – Carson Ip
    Nov 27, 2018 at 9:42
48

Root sudo timeouts are the easiest and safest way of doing this. I'll lay out all examples but be warned it is very risky any way you do this although this way is much safer:

sudo visudo

This opens an editor and points it to the sudoers file -- Ubuntu defaults to nano, other systems use Vi. You're now a super user editing one of the most important files on your system. No stress!

(Vi specific instructions noted with (vi!). Ignore these if you're using nano.)

Use the arrow keys to move to the end of the Defaults line.

(vi!) press the A (capital "a") key to move at the end of the current line and enter editing mode (append after the last character on the line).

Now type:

,timestamp_timeout=X

where X is the timeout expiration in minutes. If you specify 0 you will always be asked the password. If you specify a negative value, the timeout will never expire. E.g. Defaults env_reset,timestamp_timeout=5.

(vi!) hit Escape to return to command mode. Now, if you're happy with your editing, type in :w Enter to write the file and :q Enter to exit vi. If you made a mistake, perhaps the easiest way is to redo from start, to exit without saving (hit Escape to enter the command mode) and then type :q! Enter.

Hit Ctrl+X, then Y, then Enter to save your file and exit nano.

You might want to read the sudoers and vi manual pages for additional information.

man sudoers
man vi

Reset timeout value using:

sudo -k

These instructions are to remove the prompt for a password when using the sudo command. The sudo command will still need to be used for root access though.

Edit the sudoers file

Open a Terminal window. Type in sudo visudo. Add the following line to the END of the file (if not at the end it can be nullified by later entries):

<username> ALL=NOPASSWD: ALL

Replace <username> with your username (without the <>). You can alternately use the group users or any other such group you are in if you prepend %. Just make sure you are in that group. This can be checked by going to System -> Administration -> Users and Groups.

Example:

michael ALL=NOPASSWD: ALL

Type in ^X (Ctrl+X) to exit. This should prompt for an option to save the file, type in Y to save.

Log out, and then log back in. This should now allow you to run the sudo command without being prompted for a password.

The root account

Enabling the root account

Enabling the root account is rarely necessary. Almost everything you need to do as administrator of an Ubuntu system can be done via sudo or gksudo. If you really need a persistent root login, the best alternative is to simulate a Root login shell using the following command:

sudo -i

However, if you must enable root logins, you can do it like this:

sudo passwd root

Re-disabling your root account

If for some reason you have enabled your root account and wish to disable it again, use the following command in the terminal:

sudo passwd -dl root

System-wide group sudo

root$ echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

Log out, and then back in.

Reset sudo timeout

You can make sure sudo asks for password next time by running:

sudo -k
5
  • I posted this before I added, for a system wide way of doing this and others read here:
    – user209328
    Oct 30, 2013 at 1:17
  • 1
    This was a late answer, but is the most comprehensive in terms of the options it gives you.
    – jenming
    Mar 4, 2017 at 23:12
  • 1
    Hmm, on Ubuntu 18.04 MATE this works perfectly, while doing the same on Ubuntu 18.04 GNOME caused me wrinkles with the "username is not in the sudoers file..." problem. Now, this is why so many pple just hate linux - cuz it is rarely "causal" :D Just in case U run into the same... This is how you fix the problem: tecmint.com/…
    – Peter
    Nov 12, 2018 at 20:33
  • The EDITOR environment variable can set the editor used... e.g. sudo env EDITOR=/bin/nano visudo to reliably edit sudoers in nano. (update-alternatives can be used to set the editor as well) Nov 19, 2018 at 12:10
  • "This is assuming that Ubuntu has created a group": Without a % sign, it will interpreted as a username not a group
    – Daniel T
    Feb 14 at 18:05
11

From Super User comes a good answer:

Use the -S switch which reads the password from STDIN:

echo <password> | sudo -S <command>

Replace <password> with your password.

6
  • 9
    This is not suggested, because the password remains in cleartype in the shell history file. Apply any of other solutions instead. Nov 5, 2018 at 15:02
  • 3
    @HappyCactus can you place once space in front of echo so it doesn't appear in history? Nov 5, 2018 at 15:09
  • 2
    Yes this will avoid exposing the cleartext password to the history file. But do you always remember to add it ? :-) Nov 5, 2018 at 15:38
  • 2
    @HappyCactus I tend to add leading space by accident and then get annoyed when history can't be recalled :) Anyway the Super User has 129 upvotes so I think it's a good answer to leave here. People will read our comments and know of the risks and risk aversion steps. Nov 5, 2018 at 15:41
  • 5
    The HISTCONTROL variable needs to contain ignorespace for it not to be saved when prefixed with " ". This seems to be the default on Ubuntu, but can be changed... The password can still show up in ps output... NOPASSWD (ideally limited to certain commands) in sudoers seems safer... Nov 19, 2018 at 12:08
10

Of course what you want to do isn't recommended. After a while, though entering sudo becomes so automatic that its usefulness diminishes.

Another approach is to leave your sudoers file as is and, while doing something complicated to your umpteen hundred servers, enter sudo bash . That will give you a shell that will be authenticated as root until you exit it.

5
  • 13
    sudo -s or sudo -i are probably both better ideas than sudo bash, because they ensure the environment is sane and things.
    – Darael
    Jun 27, 2012 at 20:59
  • 3
    "sane and things" isn't generally in the realm of "better ideas", could someone give a technical explanation of why sudo -s or sudo -i is better than sudo bash? (Edit: Here is a relevant question askubuntu.com/questions/376199/… )
    – Nuzzolilo
    Jan 2, 2016 at 22:58
  • 2
    a number of sudo commands (thinking especially of sudo pip ...) require sudo -H (set HOME) in order for the command to run properly. In other cases, sudo -E (preserve env) may be required. Running sudo bash probably will work in most cases, but not in all, and when it doesn't, it won't be clear as to why.
    – michael
    Sep 20, 2016 at 6:43
  • 1
    sudo su is the traditional way to switch roles and start acting a sys admin.
    – QT-1
    Jan 21, 2018 at 12:49
  • Actually, sudo -s is slightly unsafer, as it runs the shell indicated in the SHELL environment variable, that could be tainted. I prefer sudo su - that uses the real root environment as if root were logged in.
    – Fjor
    Dec 22, 2021 at 5:49
10

This is a one line solution that also changes files permissions as stated in /etc/sudoers.d/README:

sudo sh -c 'echo "$(logname) ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/$(logname)' && sudo chmod 440 /etc/sudoers.d/$(logname)
9

Nice one-liner to remove sudo prompts for the current user

sudo bash -c 'echo "$(logname) ALL=(ALL:ALL) NOPASSWD: ALL" | (EDITOR="tee -a" visudo)'
4
  • 2
    I think you could just do: echo "$USER ALL=(ALL:ALL) NOPASSWD: ALL" | sudo env EDITOR="tee -a" visudo, only visudo needs sudo after all (and even env won't be needed in the default configuration, IIRC).
    – muru
    Jun 27, 2016 at 20:38
  • there's so much that could go wrong here (all user-error, of course), that it is preferred, in my very humble opinion, to edit the sudoer file directly (sudo visudo), while testing the result (with the editor still open), for those new users that might be tempted to try this "one-liner".
    – michael
    Sep 20, 2016 at 6:47
  • Thanks for the feedback! I was just quickly trying to script-ify the removal of sudo password prompt in my volatile test VMs. Feel free to suggest improvements :) Sep 21, 2016 at 16:35
  • You still need to sudo chmod 440 /etc/sudoers.d/$(logname) to correct file permissions as stated in the README in that directory.
    – paradroid
    Nov 14, 2018 at 16:33
8

One liner

sudo sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g'

4
  • Expanding on @upteryx idea.

  • This is how I've implemented the non-root, passwordless user in an ephemeral Docker Image for use in a CICD pipeline:

RUN \
    groupadd -g 999 foo && useradd -u 999 -g foo -G sudo -m -s /bin/bash foo && \
    sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
    sed -i /etc/sudoers -re 's/^root.*/root ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
    sed -i /etc/sudoers -re 's/^#includedir.*/## **Removed the include directive** ##"/g' && \
    echo "foo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
    echo "Customized the sudoers file for passwordless access to the foo user!" && \
    echo "foo user:";  su - foo -c id
4

To never prompt the current user for a password when that user uses sudo run this command:

echo "$USER ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/dont-prompt-$USER-for-sudo-password
3

Open sudo config:

sudo visudo

add following line:

# Defaults specification 
Defaults:username  !authenticate

where username is your usesrname.

0

SECURITY CONSIDERATIONS: I agree there are some cases where an user with a password has little sense, and may also decrease security. For example, if you have a shared computer with dedicated admin accounts (trusted skilled coworkers, whatever) that access only via SSH keys: you already have military-level security, so, having an extra password may be not necessary, and it causes to have another secret to be kept secret. Do your evaluations. But in that case, or similar ones...


Avoid to allow-list a single User

In any case, it's not ideal to allow-list every specific user in the sudoers configuration. It's very probably better to rely on groups instead.

For example, you can have a group "to sudo without a password". And every user in that group is allowed to do so.

A group would dramatically simplify auditing, in my opinion.

Also, with a group, you can use standard tools to manage users. This dramatically decrease human mistakes. With a group, there are less risks to break your critical sudo system.

In short, first, create a group.

Option 1: create a group "Wheel"

Some distributions adopt a dedicated group called wheel. Users in that group do not need a sudo password. To continue this tradition:

Create the wheel group (if it does not already exist):

sudo addgroup wheel

Then, edit your sudo configuration, to make that group special.

(you need to know how to edit a file from the terminal with vi or a similar editor)

sudo visudo

Add this line:

# Members of the wheel group can execute sudo without password
%wheel ALL=(ALL) NOPASSWD:ALL

Done!

Then, you can assign yourself or any other user in the wheel group, and that is all, to have no password for sudo:

sudo usermod -aG daisy wheel
sudo usermod -aG mario wheel
sudo usermod -aG peach wheel
sudo usermod -aG luigi wheel
sudo usermod -aG roby  wheel

So you can use standard User permissions to manage this, to revoke this in any moment.

Option 2: "Just change sudo"

Instead of creating a wheel group, that may be overkill for you, you can allow all your sudo users to always have no password. To do so, edit your sudo configuration:

sudo visudo

Then, identify this line (or similar):

%sudo ALL=(ALL:ALL) ALL

And replace that line with this one (or similar):

%sudo ALL=(ALL) NOPASSWD:ALL

Anyway, you can get lot of extra information in the official documentation:

https://manpages.ubuntu.com/manpages/noble/en/man5/sudoers.5.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .