30

I enter my first sudo command. I enter my password. For a while, I wont have to enter my password for subsequent sudo commands.

Now the question. I am someone who opens a lot of terminals. It would be very convenient if I don't have to enter passwords when I use sudo in the terminals I open after my first sudo, for the short time when I wont have to enter password for sudo in the terminal from which I have used sudo for the first time. (Sorry for the long sentence!)

Is it possible? If not, why? If yes, how?

  • 4
    Have you considered that by doing so you're opening the security hole which that mechanism exists to close? The reason that you have to enter your password with sudo is to guard against the circumstance that an attacker somehow has gained access to a login session in your name. If you disable it and someone manages to hijack one of your terminal sessions (are they all on the same console?) or in some other way gains access to a login session in your name without knowing your password, they will be able to run any command as root. Not a very likely scenario, but something you should consider. – Pepijn Schmitz Jul 1 '15 at 15:44
50

Sure it is. Run sudo visudo and add this line to your sudoers file:

Defaults        !tty_tickets

As explained in man sudoers:

 tty_tickets       If set, users must authenticate on a per-tty basis.
                   With this flag enabled, sudo will use a separate record
                   in the time stamp file for each tty.  If disabled, a
                   single record is used for all login sessions.  This
                   flag is on by default.

By setting tty_tickets to off (that's what the ! means), you enable a single authentication to be shared by multiple sessions.

  • 1
    The only thing I do differently here when advising users is to use a sudoers.d file instead. That way if they somehow screwup very easy to recover, just delete that file. Ex. sudo visudo -f /etc/sudoers.d/01_file – doug Jul 1 '15 at 13:14
  • What happens when sudo timeout ends? or run something like sudo -k? – Maythux Jul 1 '15 at 13:15
  • @Maythux you need to enter it again. This just makes a single identification work for all shell sessions. Nothing else. – terdon Jul 1 '15 at 13:24
  • @user3073656 ah, cool, that makes more sense :). Yes, please, I will delete mine. – terdon Jul 1 '15 at 13:45
  • I should note that if I use this method, the password will expire only at timeout of 15 minutes, even if I reboot which poses a security concern. So maybe add sudo -k to /etc/rc6.d? – daltonfury42 Jul 1 '15 at 13:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.