1

I'm wondering why does sudo actually NEED the password, when the user has already logged in?

The fact that the user has managed to run sudo means that the user has passed authentication and is authorized to do that.

So why does sudo need to ask for authentication again?

NOTE: I'm not actually trying to disable the password; just asking from curiosity.

  • 4
    Obligatory xkcd: xkcd.com/1200 – muru Mar 19 '15 at 18:18
  • Well, how do we know if the user didn't log in and then leave for cup of coffee ? The fact tat the user has managed to run sudo means that the user has passed authentication, the user is in sudoers file, belongs to sudoers group, but why would he/she need to stay through out the session with sudo privileges ? there's root account for that, right ? Just some thoughts – Sergiy Kolodyazhnyy Mar 20 '15 at 6:49
1

sudo asks for your password by default. It is not recommended, but you may bypass passwords for users/groups for all, or limited commands, if you chose to do so.

Here is why sudo asks for a password by default:

Linux is a multi-user system, and the easiest way to see this is to look at the root user, vs your own user. Major system-critical components are protected by being accessible by only root. This is why people suggest you create an alternate user than root when doing daily tasks. Imagine the following command run as both users (root and you):

  1. apt-get purge ubuntu-desktop #DO NOT RUN THIS

If you're cruising around as root, you've just removed ubuntu-desktop; If you're logged in as a normal user, you'll get an error.

Now, imagine how many different programs you run, and how connected to the internet they all are. Each of these clients/internet-connectable programs that you run are attack vectors or ways for people to gain entry into your machine.

Let's say that there is a new exploit for your favourite browser firefox that allows the attacker to gain shell. Would you rather the user have YOUR shell, or your ROOT shell?

This is why sudo asks you for your password.

0

The user you are logged in as does not have all of the abilities necessary to perform all commands, this is to protect the system from accidental or intentional damage. Normally root and your username will have different passwords and only the system administrator will know the root password. It is a little different on a 1 user system where your username and root's password tend to be the same. So while it may been like you already have been authorized this is not the full picture...

0

Your account is member of the wheel/sudo group which allows you to perform super user commands, but it's not an "administrative" account like root.

It is possible to use your root account to log on, removing the need to sudo. However, that practice is discouraged since it would expose the system to serious threats.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.