1

I recently changed my sudo password timeout (the amount of time that passes before sudo asks you for your password again). It defaults to 15 minutes; I raised that to an hour with sudo visudo and changing Defaults env_reset,timestamp_timeout=60. You can make sudo never ask for a password again, however, by setting it to -1.

While I have a feeling that every admin under the sun will tell me this is a bad idea, I'm wondering what the specific security risks are. If someone is logged in as me, don't they already have my password? What specific scenario will having a non-infinite password timeout protect me from?

My Ubuntu box runs a web server exposed to the public.

1

The sudo timeouts apply only to the current shell session. Try this:

  • Open a terminal
  • Run sudo ls. You will be asked for a password
  • Run sudo ls again. You will not be asked for a password because the timeout hasn't yet expired
  • Open another terminal window
  • Run sudo ls in the new terminal. You will be asked for your password even though the timeout for the first session hasn't expired yet.

Your biggest risk of long sudo timeout is if you use sudo and then go for a coffee someone might reuse your sudo capabilities while you are away.

  • This is exactly the information I was looking for. So, it only applies to my current session, and that means in theory it's mostly safe to do. – felwithe Jun 2 '14 at 13:23
  • Either that, or just run a root shell sudo -i When done or leaving your workstation / server, exit out of the shell. – Panther Jun 2 '14 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.