3

Even when I am logged in as a non-admin user, when I enter sudo bash or sudo -s, the system does not ask for any password. In the command history, I have not entered any password for sudo earlier (i.e., sudo did not cache any user credentials which might cause it to not ask for my password again in this session.)

Why is this strange behavior? And how do I make sure that every sudo and su command requires a corresponding password? And how to strictly ensure that any user cannot get root privileges without entering the root password?

Here is the content of my /etc/sudoers file:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD:ALL

marked as duplicate by Radu Rădeanu, terdon, Braiam, Warren Hill, souravc Mar 20 '14 at 18:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • possible dup of either this, this or this. – Registered User Mar 17 '14 at 11:23
  • 1
    Can you paste contents of /etc/sudoers file to pastebin.ubuntu.com and post the link to your question? Also what is the output of ls /etc/sudoers.d? – jobin Mar 17 '14 at 11:24
  • here is sudoers pastebin.ubuntu.com/7107623 and /etc/sudoers.d does not have any files except README – codeofnode Mar 17 '14 at 11:32
4

This is caused by the last line of your /etc/sudoers file, which states:

ALL ALL=(ALL) NOPASSWD:ALL

...meaning "all users can execute all commands as root without any password".

I don't know how that line got in there, but if you remove it you will restore the normal behavior. Note: use visudo for editing to make sure you don't get any syntax errors in there, i.e., execute the command

sudo visudo

and edit the file using the editor that pops up.

Not the answer you're looking for? Browse other questions tagged or ask your own question.