9

Consider this: You type $sudo apt-get upgrade and get a list of things that need upgrading with a "Y\n" confirmation. before you can read the list, and type "Y" or "n", the phone rings, or your boss comes in, or you do some thing else. You come back an hour later, and hit Y to install updates.

you are not prompted again for a password. presumably, any more sudo commands in the shell will execute, because the timer has been on hold waiting for the user input. Or a user can kill the update process and do something like sudo -i and simply stay in root indefinitely.

I am using ubuntu mate 14.04

is this a noteworthy security exception? Should I try to report it some place? If so, where?

8
  • 5
    What do you mean by "presumably"? Have you tried it or not? – luckyrumo Jun 24 '15 at 15:57
  • 3
    I did try this just now, even with Defaults passwd_timeout=3 in my sudoers file, upon running sudo apt-get upgrade password isn't asked. That's no good – Sergiy Kolodyazhnyy Jun 24 '15 at 16:01
  • I don't have the issue, with standard settings on Ubuntu 15.04 – luckyrumo Jun 24 '15 at 19:34
  • 1
    @TobiasKienzler nope. I haven't altered my sudoers file in any way except for adding that passwd_timeout part. Chech my answer. The issue was with timestamp timeout. These are different options – Sergiy Kolodyazhnyy Jun 25 '15 at 9:05
  • 1
    @Serg I see, there are two timeouts. How conveniently confusing :/ Thanks :) – Tobias Kienzler Jun 25 '15 at 9:35
22

You aren't prompted for a password because sudo has done it's job and started apt-get as root. While it's in the prompt, the apt-get process is still running, and so since it's still running as root, there's no need to enter your password again.

In other words, as long as a sudo'ed process is running, you won't be asked to enter your password again for that process; sudo doesn't interrupt the process every 15 minutes (the default timeout) and ask for your password.

Now, if you were to open another terminal and try to run another process under sudo, then you will be prompted for your password.

1
  • 5
    ... or indeed in the same terminal, after the paused sudo command has completed – steeldriver Jun 24 '15 at 16:27
3

sudo's default timestamp_timeout variable is 15 minutes. This means that if you click n on sudo apt-get upgrade within 15 minutes, you can anticipate entering root shell with sudo -i. That's exactly what happened. However, if you set that in /etc/sudoers as Default timestamp_timeout 0 , you will be prompted for it every time. Personally, I've set it to 3. If your sudo doesn't time out even after 15 minutes, then there's something seriously wrong with your sudo binary.

This behavior isn't a security hole, but rather a "convenience feature" for the sudo users. However, I can agree that for tighter security the timestamp_timeout has to be set to much shorter time than 15 minutes.

Note: passwd_timeout option that I've mentioned in my comment actually times out the password prompt when you don't type in password for x minutes. That's one of the nice moments where you realize that you should read man sudoers much more carefully.

1
  • 2
    note you shouldn't ever edit /etc/sudoers directly, use visudo instead which checks for syntax errors before replacing sudoers with a faulty file that might otherwise entirely lock you out from root access – Tobias Kienzler Jun 25 '15 at 8:36
0

I would suggest you to type sudo apt-get upgrade && exit this will exit the terminal after finishing upgrading. When the upgrading is cancelled the terminal won't close but I think that won't be the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.