6

For example if i run sudo apt-get install vlc,it asks me to enter the sudo password.

If i not enter the password for sudo it [sudo] password for avinash: remains for longtime.

How do i set this sudo password waiting time?If this waiting time expires,it automatically shows time expires.Is that possible?

Note: I am not asking about how long sudo remembers the password(RootSudoTimeout - Community Ubuntu Documentation).

1
  • What are you really trying to accomplish?
    – guntbert
    Jan 7, 2014 at 20:53

3 Answers 3

5

To change the timeout for the password prompt, you can edit /etc/sudoers (or /etc/sudoers.d/passwd_timeout) and add the line

Defaults passwd_timeout=10

or use another number than 10.

From man sudoers:

 passwd_timeout    Number of minutes before the sudo password prompt times out, or 0 for
                   no timeout.  The timeout may include a fractional component if minute
                   granularity is insufficient, for example 2.5.  The default is 5.
3
  • OP says "Note: I am not asking about how long sudo remembers the password" Jan 30, 2019 at 17:23
  • @KristopherIves Exactly!
    – Tyilo
    Jan 30, 2019 at 17:32
  • 2
    @KristopherIves That would be timestamp_timeout: "Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's time stamp will not expire until the system is rebooted. This can be used to allow users to create or delete their own time stamps via “sudo -v” and “sudo -k” respectively."
    – Tyilo
    Jan 30, 2019 at 17:34
3

This is not directly possible from sudo itself, but it is possible with some hackish technique.

sudo_timeout.sh :

#!/bin/bash

timeout=10 #seconds

set -m

echoerr() { echo "$@" 1>&2; }

keep_eye_on() {
    pid=$1
    time_passed=0
    while kill -0 $pid &> /dev/null; do
        sleep 1
        let time_passed=time_passed+1
        if [ $time_passed -ge $timeout ]; then
            echoerr "Timeout reached."
            kill -9 $pid
            exit 1
        fi
    done
}

if [ -z "$1" ]; then
    echoerr "Please specify a process to run!" 
    exit 1
fi;

sudo $@ &
pid=$!

keep_eye_on $pid &
while true; do
    if kill -0 $pid &> /dev/null; then
        fg sudo > /dev/null; [ $? == 1 ] && break;
    else
        break
    fi
done

The timeout variable holds the timeout in seconds to wait prior killing the sudo process that is asking for password.

Usage:

./sudo_timeout.sh <command>

Example:

./sudo_timeout.sh ls -al

In case the timeout is reached you get:

alex@MaD-pc:~$ ./sudo_timeout.sh ls -al
[sudo] password for alex: Timeout reached.
./sudo_timeout.sh: line 34: 14583 Killed                  sudo $@

In case you type in your password prior the timeout, then the command executes normally.

Disclaimer: The above is tested with simple commands like ls and nano, both with and without arguments, but I cannot guarantee that it will work in every case because I haven't thoroughly tested it, it's just something I came up with.

5
  • 2
    @AvinashRaj: if you rename the script to sudo and place it in a directory which comes in PATH earlier than /usr/bin - for example, in /home/avinash/bin - then the script will effectively replace the standard sudo command. Exactly what you need, right?
    – Sergey
    Jan 7, 2014 at 21:26
  • 1
    You may as well make an alias in your ~/.bashrc
    – hytromo
    Jan 8, 2014 at 13:04
  • @Sergey this code is very good as long as it is run as it is shown. If you bring it in PATH and rename it as sudo it will call itself (as it is using sudo not /usr/bin/sudo) and you will have an infinite loop. Is it not so?
    – sourav c.
    Jan 10, 2014 at 3:29
  • 1
    @souravc: Yes, but changing sudo invocation in the script to /usr/bin/sudo would solve the problem.
    – Sergey
    Jan 11, 2014 at 3:23
  • Caution: this script will kill your program after the timeout. The timeout is not just applied to the password asking itself!! Nov 5, 2015 at 12:23
3

Easy using sudo's SUDO_ASKPASS feature.

Create this script sudo-askpass-timeout.sh somewhere:

#! /bin/bash -eu
# dash doesn't support read -s, so we use bash instead

# "read" will not reset the terminal echo mode if it is canceled. Let's save/restore the tty status.
stty_orig=`stty -g`
trap 'stty "$stty_orig"' EXIT

## Default timeout is 60 seconds.
if read -s -t ${READ_TIMEOUT:-60} -p "$*"
then
    echo "$REPLY"
else
    echo "Timeout" >&2
    exit 1
fi

Then, create a something like sudo-timeout.sh in the same directory:

#! /bin/bash -eux

## Syntax:  sudo-timeout.sh [-t timeout_in_seconds] <sudo arguments>
## Example:  sudo-timeout.sh -t 60 apt-get update

export SUDO_ASKPASS="$(dirname "$0")/sudo-askpass-timeout.sh"
export READ_TIMEOUT=60
if [ $# -ge 3  ] && [ "$1" = "-t" ]
then
        shift
        READ_TIMEOUT=$1
        shift
fi
exec sudo -A "$@"

Example:

sudo-timeout.sh apt-get update  ##Default: 60 second timeout
sudo-timeout.sh -t 30 apt-get update
1
  • 2
    Gravedigging... This is the correct answer ! Mar 20, 2018 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .