6

For example if i run sudo apt-get install vlc,it asks me to enter the sudo password.

If i not enter the password for sudo it [sudo] password for avinash: remains for longtime.

How do i set this sudo password waiting time?If this waiting time expires,it automatically shows time expires.Is that possible?

Note: I am not asking about how long sudo remembers the password(RootSudoTimeout - Community Ubuntu Documentation).

  • What are you really trying to accomplish? – guntbert Jan 7 '14 at 20:53
3

This is not directly possible from sudo itself, but it is possible with some hackish technique.

sudo_timeout.sh :

#!/bin/bash

timeout=10 #seconds

set -m

echoerr() { echo "$@" 1>&2; }

keep_eye_on() {
    pid=$1
    time_passed=0
    while kill -0 $pid &> /dev/null; do
        sleep 1
        let time_passed=time_passed+1
        if [ $time_passed -ge $timeout ]; then
            echoerr "Timeout reached."
            kill -9 $pid
            exit 1
        fi
    done
}

if [ -z "$1" ]; then
    echoerr "Please specify a process to run!" 
    exit 1
fi;

sudo $@ &
pid=$!

keep_eye_on $pid &
while true; do
    if kill -0 $pid &> /dev/null; then
        fg sudo > /dev/null; [ $? == 1 ] && break;
    else
        break
    fi
done

The timeout variable holds the timeout in seconds to wait prior killing the sudo process that is asking for password.

Usage:

./sudo_timeout.sh <command>

Example:

./sudo_timeout.sh ls -al

In case the timeout is reached you get:

alex@MaD-pc:~$ ./sudo_timeout.sh ls -al
[sudo] password for alex: Timeout reached.
./sudo_timeout.sh: line 34: 14583 Killed                  sudo $@

In case you type in your password prior the timeout, then the command executes normally.

Disclaimer: The above is tested with simple commands like ls and nano, both with and without arguments, but I cannot guarantee that it will work in every case because I haven't thoroughly tested it, it's just something I came up with.

  • 2
    @AvinashRaj: if you rename the script to sudo and place it in a directory which comes in PATH earlier than /usr/bin - for example, in /home/avinash/bin - then the script will effectively replace the standard sudo command. Exactly what you need, right? – Sergey Jan 7 '14 at 21:26
  • 1
    You may as well make an alias in your ~/.bashrc – hytromo Jan 8 '14 at 13:04
  • @Sergey this code is very good as long as it is run as it is shown. If you bring it in PATH and rename it as sudo it will call itself (as it is using sudo not /usr/bin/sudo) and you will have an infinite loop. Is it not so? – souravc Jan 10 '14 at 3:29
  • 1
    @souravc: Yes, but changing sudo invocation in the script to /usr/bin/sudo would solve the problem. – Sergey Jan 11 '14 at 3:23
  • Caution: this script will kill your program after the timeout. The timeout is not just applied to the password asking itself!! – Raúl Salinas-Monteagudo Nov 5 '15 at 12:23
2

Easy using sudo's SUDO_ASKPASS feature.

Create this script sudo-askpass-timeout.sh somewhere:

#! /bin/bash -eu
# dash doesn't support read -s, so we use bash instead

# "read" will not reset the terminal echo mode if it is canceled. Let's save/restore the tty status.
stty_orig=`stty -g`
trap 'stty "$stty_orig"' EXIT

## Default timeout is 60 seconds.
if read -s -t ${READ_TIMEOUT:-60} -p "$*"
then
    echo "$REPLY"
else
    echo "Timeout" >&2
    exit 1
fi

Then, create a something like sudo-timeout.sh in the same directory:

#! /bin/bash -eux

## Syntax:  sudo-timeout.sh [-t timeout_in_seconds] <sudo arguments>
## Example:  sudo-timeout.sh -t 60 apt-get update

export SUDO_ASKPASS="$(dirname "$0")/sudo-askpass-timeout.sh"
export READ_TIMEOUT=60
if [ $# -ge 3  ] && [ "$1" = "-t" ]
then
        shift
        READ_TIMEOUT=$1
        shift
fi
exec sudo -A "$@"

Example:

sudo-timeout.sh apt-get update  ##Default: 60 second timeout
sudo-timeout.sh -t 30 apt-get update
  • 2
    Gravedigging... This is the correct answer ! – Stefanos Kalantzis Mar 20 '18 at 15:39
1

To change the timeout for the password prompt, you can edit /etc/sudoers (or /etc/sudoers.d/passwd_timeout) and add the line

Defaults passwd_timeout=10

or use another number than 10.

From man sudoers:

 passwd_timeout    Number of minutes before the sudo password prompt times out, or 0 for
                   no timeout.  The timeout may include a fractional component if minute
                   granularity is insufficient, for example 2.5.  The default is 5.
  • OP says "Note: I am not asking about how long sudo remembers the password" – Kristopher Ives Jan 30 at 17:23
  • @KristopherIves Exactly! – Tyilo Jan 30 at 17:32
  • 1
    @KristopherIves That would be timestamp_timeout: "Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's time stamp will not expire until the system is rebooted. This can be used to allow users to create or delete their own time stamps via “sudo -v” and “sudo -k” respectively." – Tyilo Jan 30 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.