16

Whenever I issue command sudo apt-get install foo it does not ask for password. is it because of user groups?

How to make it prompt for password?

Edit: My sudoers file

apple@Ascension:~$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
9
  • is your user login password blank or auto-login?
    – ish
    May 20 '12 at 9:42
  • 1
    share your /etc/sudoers please
    – daisy
    May 20 '12 at 11:24
  • 1
    remove the last 3 lines of sudoers , your problem will be solved.
    – daisy
    May 21 '12 at 1:05
  • 1
    @warl0ck I didn't edit sudoers then how it get appended in sudoers. Can you explain? BTW it is solved now. May 21 '12 at 8:04
  • 1
    @virpara the last three lines functions as single one , that will anyone in any machine to launch any commands without password prompting.
    – daisy
    May 22 '12 at 3:15
16

With the command sudo visudo you can see and edit, the sudo configuration, for example :

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Group without password
%nopwd  ALL=NOPASSWD: ALL

Your current user is probably member of a privileged group that enables him to enter sudo commands without password. In this example members of admin and sudo group can issue any command with sudo, but are prompted with a password ; members of the nopwd group are not prompted with a password.

Note that the declaration order is relevant for users belonging to multiple groups. Unintuitively, the LAST matching group wins !

In order to require a password, you can add the PASSWD: /usr/bin/apt-get command specification in file /etc/sudoers ; note that you probably want to allow specific commands with no password, and keep every other command with a password. An example explicitely requesting a password for apt-get:

%users  ALL=NOPASSWD: /sbin/reboot, PASSWD: /usr/bin/apt-get

Note that you can personnalize sudo with a much finer granularity than allow all commands like in my first example (doc ubuntu fr)(doc ubuntu en).

Not the answer you're looking for? Browse other questions tagged or ask your own question.