19

Is there a way to force the sudo command to ask for a password each time when I'm using sudo rm /path/file?

I want to protect my self from stupid mistakes, committed due to low attention when I'm running some commands from the history.

  • 3
    In a normally setup system sudo asks for a password no matter what command you run. – Pilot6 Dec 12 '19 at 18:58
  • 6
    @Pilot6, yes, but as you know, by default, within the next 15 minutes it doesn't ask. So I would want to force sudo to ask for a password each time when rm is engaged. – pa4080 Dec 12 '19 at 19:01
  • 1
    something like this: askubuntu.com/questions/636092/… – bac0n Dec 12 '19 at 19:06
  • Hello, @Kulfy, what you mean by k option? – pa4080 Dec 12 '19 at 19:20
  • 3
    Although it is related and of interest, I don't think this question is a duplicate of How to get sudo to prompt you for a password each time, because that question is about how to do it for all commands, and this question is about how to do it for a specific command. At least as written, the answers there don't explain how they would be adapted to apply to the single-command case asked about here. – Eliah Kagan Dec 12 '19 at 20:03
24

As noted in other answers, sudo can set a timeout on the cached credential timestamp. This can be done specifically for a given command using Defaults in sudoers:

Defaults!/bin/rm timestamp_timeout=0

Always remember to edit sudoers with visudo. I recommend a drop-in file in /etc/sudoers.d instead of editing /etc/sudoers directly. For example:

sudo visudo -f /etc/sudoers.d/always-ask-pass-for-rm

From the manpage for sudoers:

Defaults

Certain configuration options may be changed from their default values at run-time via one or more Default_Entry lines. These may affect all users on any host, all users on a specific host, a specific user, a specific command, or commands being run as a specific user. Note that per-command entries may not include command line arguments. If you need to specify arguments, define a Cmnd_Alias and reference that instead.

Default_Type ::= 'Defaults' |
                 'Defaults' '@' Host_List |
                 'Defaults' ':' User_List |
                 'Defaults' '!' Cmnd_List |
                 'Defaults' '>' Runas_List

Default_Entry ::= Default_Type Parameter_List

Parameter_List ::= Parameter |
                   Parameter ',' Parameter_List

Parameter ::= Parameter '=' Value |
              Parameter '+=' Value |
              Parameter '-=' Value |
              '!'* Parameter

Note that it does say you can affect "commands being run as a specific user", but doesn't mention commands being run by a specific user, so it might not be possible to constrain it only for your user. The examples in the manpage don't include anything for that.

  • ln -s /bin/rm rmdo; sudo ./rmdo <file> – bac0n Dec 13 '19 at 8:27
  • 7
    @bac0n I'm operating under the assumption that this is more to deter accidental gun-to-foot scenarios rather than to prevent deliberate attack. Otherwise one would be pretty dumb to allow arbitrary sudo commands for any account with shell access. – sudo mcsudoface Dec 13 '19 at 8:33
  • Great first time answer from a user account created just today! It's like my own answer below on steroids. Well done. – WinEunuuchs2Unix Dec 13 '19 at 12:46
  • How do I adopt this method when there isn't any specific executable binary, for eg. Shell in-built commands? – Kulfy Dec 13 '19 at 14:39
  • 2
    @Kulfy sudo only runs external commands. sudo alias gives the error "sudo: alias: command not found" outside the unusual case that you also have an external command called alias. Some shells, like Bash, have some builtins that shadow external commands. If one tries to run them with sudo, one really runs the same-named external commands. For example, sudo kill, sudo printf, and sudo echo run external commands. See Why doesn't `sudo cd /var/named` work?, Why is there a /bin/echo and why would I want to use it?. – Eliah Kagan Dec 13 '19 at 15:08
13

You can use k option with sudo to reset the timestamp.

If sudo -k is used as a command, it would expire/invalidate the cached credentials immediately.

But if sudo -k is used with some command, for example, sudo -k rm /some/file, the shell would ask for password even if some credentials are already cached. In this case, the new credentials won't be cached. That means if another command with sudo is executed after that, it won't ask for password (if credentials were cached previously).

From sudo's manpage:

-k [command]

        When used alone, the -k (kill) option to sudo invalidates the user's cached credentials. The next time sudo is run a password will be required. This option does not require a password and was added to allow a user to revoke sudo permissions from a .logout file. Not all security policies support credential caching.

        When used in conjunction with a command or an option that may require a password, the -k option will cause sudo to ignore the user's cached credentials. As a result, sudo will prompt for a password (if one is required by the security policy) and will not update the user's cached credentials.

If you want to make sudo to ask for password for specific commands without using k every time, you can define custom functions in .bashrc. For example, from pa4080's comment:

sudo() { if [[ $@ =~ ^rm ]]; then /usr/bin/sudo -k "$@"; else /usr/bin/sudo "$@"; fi; }
  • it is easy to circumvent by using full path to sudo so i think it gives a false sense of security. – bac0n Dec 13 '19 at 7:06
  • 3
    @bac0n, I agree that this is easy to circumvent, but I don't think this means that it gives a false sense of security. The use-case here is like a fire alarm with a cover over it; the cover isn't to stop malicious users from triggering the alarm, it's to stop an inattentive user from accidentally leaning against the button. The fact that it's easy to deliberately bypass is kind of the intention, not an exploit. – ymbirtt Dec 13 '19 at 9:42
3

You can set sudo to always ask for a password:


$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset, timestamp_timeout=120, pwfeedback
#Defaults   mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

In my configuration I have sudo timeout set at 2 hours (120 minutes) before it asks for a password again. Setting it to 0 will require password every time you use sudo

  • Why set it to 1 minute? The OP asks for no caching of credentials; set it to 0. – chepner Dec 13 '19 at 4:22
  • But why so much emphasis on the values the user isn't asking about? Setting it to 0 seems like an afterthought, when it should be the entire answer. – chepner Dec 13 '19 at 4:29
  • @chepner I've revised answer. Thanks. – WinEunuuchs2Unix Dec 13 '19 at 4:51
2

rm wrapper script

Sometime ago I wrote a wrapper script for the rm command:

Some of the notable features:

  • An encrypted password must be used each time rm is called unless it is being used within a batch job like sudo apt-get or sudo update-grub.
  • Ensure top level directories are never removed even if a relative path was passed.
  • Every time rm is used it is logged to journalctl and /var/log/syslog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.