12

Whenever I issue command sudo apt-get install foo it does not ask for password. is it because of user groups?

How to make it prompt for password?

Edit: My sudoers file

apple@Ascension:~$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
  • is your user login password blank or auto-login? – ish May 20 '12 at 9:42
  • What do you mean by 'not ask for password' , did the command get executed ? Did you receive any output ? – daisy May 20 '12 at 10:22
  • @izx it is neither blank nor auto-login. – Rahul Virpara May 20 '12 at 11:11
  • 1
    share your /etc/sudoers please – daisy May 20 '12 at 11:24
  • 1
    remove the last 3 lines of sudoers , your problem will be solved. – daisy May 21 '12 at 1:05
14

With the command sudo visudo you can see and edit, the sudo configuration, for example :

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Group without password
%nopwd  ALL=NOPASSWD: ALL

Your current user is probably member of a privileged group that enables him to enter sudo commands without password. In this example members of admin and sudo group can issue any command with sudo, but are prompted with a password ; members of the nopwd group are not prompted with a password.

Note that the declaration order is relevant for users belonging to multiple groups. Unintuitively, the LAST matching group wins !

In order to require a password, you can add the PASSWD: /usr/bin/apt-get command specification in file /etc/sudoers ; note that you probably want to allow specific commands with no password, and keep every other command with a password. An example explicitely requesting a password for apt-get:

%users  ALL=NOPASSWD: /sbin/reboot, PASSWD: /usr/bin/apt-get

Note that you can personnalize sudo with a much finer granularity than allow all commands like in my first example (doc ubuntu fr)(doc ubuntu en).

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.