0

This is for a 12.04 ec2 instance.

In the man pages it says the default should be to require a password when using sudo. I thought by setting the ubuntu's account password (in case it wasn't set) that might start prompting me for a password when using sudo, but when I used the passwd command it required me to enter the original password before allowing me to change it. So, even though it appeared to be set already, it wasn't prompting me for a sudo pass, and after I used sudo to override and change the ubuntu account password, it still is not asking for a sudo pass.

Anyway, I'm not sure how important those details actually are. Here is my sudoers file:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults     env_reset
Defaults     secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

In all the examples I've come across where people didn't know why they had passwordless sudo setup, it seemed to be because of some sort of explicit "NOPASSWD:ALL" line in the sudoers file (which mine doesn't have). I tried doing:

%admin ALL:(ALL) PASSWD: ALL

but it didn't help.

id output:

uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),110(netdev),111(admin)
0

1 Answer 1

2

The ubuntu user makes me think that this is some kind of a live environment. In the live environment the ubuntu user has passwordless sudo access, because that is the purpose of the live environment.

In the above case the passwordless sudo access is defined in a file in the /etc/sudoers.d/ directory, more exactly the /etc/sudoers.d/casper contains this:

ubuntu  ALL=(ALL) NOPASSWD: ALL

So I think you have such a file in the /etc/sudoers.d/ directory. (Or another similar file with the same purpose, if you have a non-standard ubuntu installation.) You have to remove that file, or edit it to the way you like.

3
  • The file on my ec2 instance is '/etc/sudoers.d/90-cloudimg-ubuntu'. I guess changing the ubuntu account password before removing passwordless sudo is good, otherwise you'd be locked out from using sudo. I'm new to this stuff. Now I'm not sure what the significance of passwordless sudo is (other than not being locked out from the get-go) in the so called live environment. I was under the impression passwordless sudo posed more of a security risk.
    – Kevin
    Feb 8, 2014 at 21:40
  • @Kevin It is important to know the password of the account with sudo access of course. If you don't know it, then of course change it. Yes, passwordless sudo is less secure. A live environment is one which you can boot up from an USB or DVD, like a recovery disk, because it is not a system used for normal operation, just mostly for try-out or recovery, it is unimportant to set a sudo password, as it would just make things uncomfortable. (So you don't have a live environment, just a non-standard ubuntu install, which had a different setting for sudo.)
    – falconer
    Feb 8, 2014 at 21:54
  • EC2 uses ssh keys instead of passwords to allow access to the instance. Since the ubuntu user does not have a password (not even an empty one), it cannot be required on sudo. You can create a password for the user and edit the appropriate sudoers file to require it on sudo. Feb 8, 2014 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .