14

Say I execute a command with sudo, then if I use sudo within the next 15/5 minutes (not sure how long it remembers me for) it won't prompt me for a password. It will only prompt me again if I haven't used it for at least that long.

However, if I suspend my machine, wake it up, and login before that time period has ended, I can just execute a sudo command again and it won't ask me for my password because I haven't let it be for the certain amount of time.

So how can I make it so that no matter how long I haven't used sudo for, it will definitely prompt me for a password after the suspend once I've logged in again, even if I'm still within that time frame where the 15/5 minutes of not using sudo haven't passed yet?

The most likely thing that will work is to get it to execute a command to remove all identity caches for sudo upon the execution of a certain command which is executed on wakeup.

I am running Ubuntu GNOME 15.10 with GNOME 3.18.

6
  • 1
    good question, but why you are paranoid? because if the person other than you knows your login password cannot be stopped from using sudo
    – Alex Jones
    Jan 3, 2016 at 17:56
  • If you just exit that terminal window, you'll need to re-type your password when you open a new terminal window no matter how quickly you do it. If you're running something in a terminal window, append ` ; exit` and the window will close when the command completes.
    – Marc
    Jan 3, 2016 at 17:59
  • @Marc: I know, but it's not always convenient to exit, nor to manually make sudo ask you next time. An automatic solution would be preferred.
    – user364819
    Jan 3, 2016 at 18:01
  • @edwardtorvalds: Well, I could login again, and then go away (not that I do that very often), and then when somebody comes it would be bad if they could just use sudo. I know that sounds a bit strange for my own computer, but I could have been doing some maintenance work on another Ubuntu computer, and then when I log the user back in again, it might be inconvenient to close Terminal, but I don't want them to have sudo rights.
    – user364819
    Jan 3, 2016 at 18:02
  • 1
    Appending ` ; exit` (seven keystrokes) seems pretty easy to me. What kinds of maintenance do you walk away from, because I can't think of much I'd take a chance on suspending in the middle of.
    – Marc
    Jan 3, 2016 at 18:34

3 Answers 3

19

From man sudo:

     -K, --remove-timestamp
                 Similar to the -k option, except that it removes the user's
                 cached credentials entirely and may not be used in conjunc‐
                 tion with a command or other option.  This option does not
                 require a password.  Not all security policies support cre‐
                 dential caching.

So what you want is your user to run sudo -K each time the system suspends.

Ubuntu 15.04+ (systemd)

This can be done on Ubuntu 15.04+ by placing a script in /lib/systemd/system-sleep/.

  1. Run sudo nano /lib/systemd/system-sleep/disable_sudo_user (replace user with your user's username for convenience);
  2. Paste in the following script (replace user with your user's username):
#!/bin/sh
case $1/$2 in
    pre/suspend)
        su user -c 'sudo -K'
        ;;
esac
  1. Hit CTRL+O, ENTER and CTRL+X;

  2. Run sudo chmod o+x /lib/systemd/system-sleep/disable_sudo_user;


To enable this also for hibernation / hybrid-sleep, use this script instead:

#!/bin/sh
case $1 in
    pre)
        su user -c 'sudo -K'
        ;;
esac

Previous Ubuntu versions (Upstart)

This can be done on previous Ubuntu versions by placing a script in /etc/pm/sleep.d/.

  1. Run sudo nano /etc/pm/sleep.d/disable_sudo_user (replace user with your user's username for convenience);
  2. Paste in the following script (replace user with your user's username):
#!/bin/sh
case $1 in
    suspend)
        su user -c 'sudo -K'
        ;;
esac
  1. Hit CTRL+O, ENTER and CTRL+X;

  2. Run sudo chmod o+x /etc/pm/sleep.d/disable_sudo_user;


To enable this also for hibernation, use this script instead:

#!/bin/sh
case $1 in
    suspend|hybernate)
        su user -c 'sudo -K'
        ;;
esac
8
  • 2
    It would have been funnier if you used sudo -u user sudo -k. :D
    – muru
    Jan 3, 2016 at 18:50
  • @muru Thought the same but for some reason it looked a bit silly :D
    – kos
    Jan 3, 2016 at 18:58
  • Sorry, haven't written any shell code for a while, what exactly does this pre/*) do? :)
    – user364819
    Jan 3, 2016 at 19:17
  • @ParanoidPanda It's gone, see the update. See here (Description, second paragraph): systemd-suspend.service calls the scripts in /lib/systemd/system-sleep/ passing two arguments; $1 it's either pre for pre-sleep events or post for post-sleep events, and $2 it's either suspend, hybernate or hybrid-sleep; pre/* was meant to catch all combinations of pre/ and any of suspend, hybernate or hybrid-sleep, but since you asked explicitly for suspension I changed it to pre/suspend.
    – kos
    Jan 3, 2016 at 19:34
  • 1
    Worth noting that you can do this in older ubuntu as well, it's just the mechanism that's different, i.e. using /etc/pm/sleep.d scripts.
    – hobbs
    Jan 3, 2016 at 23:42
3

Only if you are that paranoid! You can use the -K option of sudo.

-K, --reset-timestamp
       When used without a command, invalidates the user's cached credentials.  
       In other words, the next time sudo is run a password will be required.  
       This option does not require a password and was added to allow a user to revoke
       sudo permissions from a .logout file.

       When used in conjunction with a command or an option that may require a 
       password, this option will cause sudo to ignore the user's cached credentials.  
       As a result, sudo will prompt for a password (if one is required by the 
       security policy) and will not update the user's cached credentials.

       Not all security policies support credential caching.

for example,

sudo -K <command>

Or you could just leave your computer in a metal box guarded by robots :)

3
  • Hmm... Not exactly as I want though, is there no way to automate this? Because this suggests that I definitely know that I'm about to suspend, what if a command is running with sudo and I need to go somewhere, so I suspend the machine, then when I come back and unsuspend the machine, I will have to wait for the command or the time to finish before I can make it ask me for a password next time again? It would be much more useful for many reasons (including the fact that when I am running it with a GUI on a different runlevel it doesn't ask for a password after suspend) for it to be automated.
    – user364819
    Jan 3, 2016 at 18:08
  • Also, I think you mean -K and not -k.
    – user364819
    Jan 3, 2016 at 18:23
  • Well, it might be more useful anyway.
    – user364819
    Jan 3, 2016 at 18:23
1

Yet another method

Type 'sudo visudo'

Go to the line that says: 'Defaults env_reset'

and change to:

'Defaults env_reset, timestamp_timeout=0

Then save the file.

By setting the timeout to 0, the system will prompt you for the password every time.

1
  • While this does (technically speaking) accomplish what the OP is asking for, it's overkill for most situations. That said, if you are really paranoid (or just want an extra step for pause and contemplation every time you do something potentially dangerous), this might be a viable alternative.
    – user
    Apr 9, 2016 at 14:53

You must log in to answer this question.