I enter my first sudo command. I enter my password. For a while, I wont have to enter my password for subsequent sudo commands.

Now the question. I am someone who opens a lot of terminals. It would be very convenient if I don't have to enter passwords when I use sudo in the terminals I open after my first sudo, for the short time when I wont have to enter password for sudo in the terminal from which I have used sudo for the first time. (Sorry for the long sentence!)

Is it possible? If not, why? If yes, how?

  • 5
    Have you considered that by doing so you're opening the security hole which that mechanism exists to close? The reason that you have to enter your password with sudo is to guard against the circumstance that an attacker somehow has gained access to a login session in your name. If you disable it and someone manages to hijack one of your terminal sessions (are they all on the same console?) or in some other way gains access to a login session in your name without knowing your password, they will be able to run any command as root. Not a very likely scenario, but something you should consider. – Pepijn Schmitz Jul 1 '15 at 15:44
  • 1
    There should be a productivity tag, just to find questions like this. Else, have to follow the old way of keep waiting for that moment of ingenuity to come up with such questions. – saurabheights Jan 18 at 13:36

Sure it is. Run sudo visudo and add this line to your sudoers file:

Defaults        !tty_tickets

As explained in man sudoers:

 tty_tickets       If set, users must authenticate on a per-tty basis.
                   With this flag enabled, sudo will use a separate record
                   in the time stamp file for each tty.  If disabled, a
                   single record is used for all login sessions.  This
                   flag is on by default.

By setting tty_tickets to off (that's what the ! means), you enable a single authentication to be shared by multiple sessions.

  • 1
    The only thing I do differently here when advising users is to use a sudoers.d file instead. That way if they somehow screwup very easy to recover, just delete that file. Ex. sudo visudo -f /etc/sudoers.d/01_file – doug Jul 1 '15 at 13:14
  • What happens when sudo timeout ends? or run something like sudo -k? – Maythux Jul 1 '15 at 13:15
  • @Maythux you need to enter it again. This just makes a single identification work for all shell sessions. Nothing else. – terdon Jul 1 '15 at 13:24
  • @user3073656 ah, cool, that makes more sense :). Yes, please, I will delete mine. – terdon Jul 1 '15 at 13:45
  • 1
    @daltonfury42 this option does not affect the timeout. It always expires after 15 minutes. The difference is that before, the authentication only affected a single session. Adding sudo -k in /etc/rc.d won't help since that is not run by your user and won't affect your user's session. You could add it to ~/.bash_logout or ~/.profile if you like. – terdon Jul 1 '15 at 14:04

So here is what you want to do to only have sudo ask for your password once per boot:


## Only ask for the password once for all TTYs per reboot.
## See https://askubuntu.com/a/1278937/367284 and
##     https://github.com/hopeseekr/BashScripts/
Defaults !tty_tickets
Defaults timestamp_timeout = -1
  • This is essentially disabling sudo completely: most of us work on machines that rarely reboot (either servers, or laptops), which means that your approach would allow anyone who sits in front of the machine to run any command at all, as long as the machine is on and someone has at any time during this boot entered the password. This isn't what the question was asking for, and it really isn't a good idea unless you truly don't care about security at all. – terdon Oct 1 '20 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.