Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I execute a command with sudo, then if I use sudo within the next 15/5 minutes (not sure how long it remembers me for) it won't prompt me for a password. It will only prompt me again if I haven't used it for at least that long.

However, if I suspend my machine, wake it up, and login before that time period has ended, I can just execute a sudo command again and it won't ask me for my password because I haven't let it be for the certain amount of time.

So how can I make it so that no matter how long I haven't used sudo for, it will definitely prompt me for a password after the suspend once I've logged in again, even if I'm still within that time frame where the 15/5 minutes of not using sudo haven't passed yet?

The most likely thing that will work is to get it to execute a command to remove all identity caches for sudo upon the execution of a certain command which is executed on wakeup.

I am running Ubuntu GNOME 15.10 with GNOME 3.18.

share|improve this question
1  
good question, but why you are paranoid? because if the person other than you knows your login password cannot be stopped from using sudo – edward torvalds Jan 3 at 17:56
    
If you just exit that terminal window, you'll need to re-type your password when you open a new terminal window no matter how quickly you do it. If you're running something in a terminal window, append ` ; exit` and the window will close when the command completes. – Marc Jan 3 at 17:59
    
@Marc: I know, but it's not always convenient to exit, nor to manually make sudo ask you next time. An automatic solution would be preferred. – Paranoid Panda Jan 3 at 18:01
    
@edwardtorvalds: Well, I could login again, and then go away (not that I do that very often), and then when somebody comes it would be bad if they could just use sudo. I know that sounds a bit strange for my own computer, but I could have been doing some maintenance work on another Ubuntu computer, and then when I log the user back in again, it might be inconvenient to close Terminal, but I don't want them to have sudo rights. – Paranoid Panda Jan 3 at 18:02
1  
Appending ` ; exit` (seven keystrokes) seems pretty easy to me. What kinds of maintenance do you walk away from, because I can't think of much I'd take a chance on suspending in the middle of. – Marc Jan 3 at 18:34
up vote 24 down vote accepted

From man sudo:

     -K, --remove-timestamp
                 Similar to the -k option, except that it removes the user's
                 cached credentials entirely and may not be used in conjunc‐
                 tion with a command or other option.  This option does not
                 require a password.  Not all security policies support cre‐
                 dential caching.

So what you want is your user to run sudo -K each time the system suspends.

Ubuntu 15.04+ (systemd)

This can be done on Ubuntu 15.04+ by placing a script in /lib/systemd/system-sleep/.

  1. Run sudo nano /lib/systemd/system-sleep/disable_sudo_user (replace user with your user's username for convenience);
  2. Paste in the following script (replace user with your user's username):
#!/bin/sh
case $1/$2 in
    pre/suspend)
        su user -c 'sudo -K'
        ;;
esac
  1. Hit CTRL+O, ENTER and CTRL+X;

  2. Run sudo chmod o+x /lib/systemd/system-sleep/disable_sudo_user;


To enable this also for hibernation / hybrid-sleep, use this script instead:

#!/bin/sh
case $1 in
    pre)
        su user -c 'sudo -K'
        ;;
esac

Previous Ubuntu versions (Upstart)

This can be done on previous Ubuntu versions by placing a script in /etc/pm/sleep.d/.

  1. Run sudo nano /etc/pm/sleep.d/disable_sudo_user (replace user with your user's username for convenience);
  2. Paste in the following script (replace user with your user's username):
#!/bin/sh
case $1 in
    suspend)
        su user -c 'sudo -K'
        ;;
esac
  1. Hit CTRL+O, ENTER and CTRL+X;

  2. Run sudo chmod o+x /etc/pm/sleep.d/disable_sudo_user;


To enable this also for hibernation, use this script instead:

#!/bin/sh
case $1 in
    suspend|hybernate)
        su user -c 'sudo -K'
        ;;
esac
share|improve this answer
2  
It would have been funnier if you used sudo -u user sudo -k. :D – muru Jan 3 at 18:50
    
@muru Thought the same but for some reason it looked a bit silly :D – kos Jan 3 at 18:58
    
Sorry, haven't written any shell code for a while, what exactly does this pre/*) do? :) – Paranoid Panda Jan 3 at 19:17
    
@ParanoidPanda It's gone, see the update. See here (Description, second paragraph): systemd-suspend.service calls the scripts in /lib/systemd/system-sleep/ passing two arguments; $1 it's either pre for pre-sleep events or post for post-sleep events, and $2 it's either suspend, hybernate or hybrid-sleep; pre/* was meant to catch all combinations of pre/ and any of suspend, hybernate or hybrid-sleep, but since you asked explicitly for suspension I changed it to pre/suspend. – kos Jan 3 at 19:34
1  
Worth noting that you can do this in older ubuntu as well, it's just the mechanism that's different, i.e. using /etc/pm/sleep.d scripts. – hobbs Jan 3 at 23:42

Only if you are that paranoid! You can use the -K option of sudo.

-K, --reset-timestamp
       When used without a command, invalidates the user's cached credentials.  
       In other words, the next time sudo is run a password will be required.  
       This option does not require a password and was added to allow a user to revoke
       sudo permissions from a .logout file.

       When used in conjunction with a command or an option that may require a 
       password, this option will cause sudo to ignore the user's cached credentials.  
       As a result, sudo will prompt for a password (if one is required by the 
       security policy) and will not update the user's cached credentials.

       Not all security policies support credential caching.

for example,

sudo -K <command>

Or you could just leave your computer in a metal box guarded by robots :)

share|improve this answer
    
Hmm... Not exactly as I want though, is there no way to automate this? Because this suggests that I definitely know that I'm about to suspend, what if a command is running with sudo and I need to go somewhere, so I suspend the machine, then when I come back and unsuspend the machine, I will have to wait for the command or the time to finish before I can make it ask me for a password next time again? It would be much more useful for many reasons (including the fact that when I am running it with a GUI on a different runlevel it doesn't ask for a password after suspend) for it to be automated. – Paranoid Panda Jan 3 at 18:08
    
Also, I think you mean -K and not -k. – Paranoid Panda Jan 3 at 18:23
    
Well, it might be more useful anyway. – Paranoid Panda Jan 3 at 18:23

Yet another method

Type 'sudo visudo'

Go to the line that says: 'Defaults env_reset'

and change to:

'Defaults env_reset, timestamp_timeout=0

Then save the file.

By setting the timeout to 0, the system will prompt you for the password every time.

share|improve this answer
    
While this does (technically speaking) accomplish what the OP is asking for, it's overkill for most situations. That said, if you are really paranoid (or just want an extra step for pause and contemplation every time you do something potentially dangerous), this might be a viable alternative. – Michael Kjörling Apr 9 at 14:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.