1

Ever since I update to 16.04 I notice whenever I use any sudo command the terminal does not ask me the password before executing the command,The command is directly executed.I am the admin and I have no other user accounts.

I have seen sudo does not ask for password and my /etc/sudoers is exactly like given in answer but still when using sudo command, terminal does not prompt a password instead execute the command.

I would like to know in detail how can /etc/sudoers can be modified for

  • Making any particular user account(including admin) to be prompted or not prompted for password when using sudo command.

  • How to exclude any particular command to be excluded from prompting password when using sudo for any user account(including admin).

Here is my sudoers file

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#

Defaults    env_reset,timestamp_timeout=0

# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification root ALL=(ALL) ALL

# Members of the admin group may gain root privileges %admin ALL=(ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Output of sudo -l

Matching Defaults entries for bharat on ratcoder:
    env_reset, timestamp_timeout=0

User bharat may run the following commands on ratcoder:
    (ALL) NOPASSWD: ALL
  • Please add the output of sudo -l. – muru Jun 22 '16 at 15:40
  • @muru Please see I have added it in the question itself. – bha159 Jun 22 '16 at 15:55
  • some file in /etc/sudoers.d has the NOPASSWD rule. Find and delete it – muru Jun 22 '16 at 15:57
  • @muru how can I do it? There are 3 files in '/etc/sudoers.d' and they don't open. – bha159 Jun 22 '16 at 16:00
  • sudo grep NOPASSWD /etc/sudoers.d -R – muru Jun 22 '16 at 16:01
1

You had a NOPASSWD rule applied to your user in some file in /etc/sudoers.d. Use sudo grep NOPASSWD /etc/sudoers.d -R to find out which.

Your /etc/sudoers is not the default, however. The default sudoers can be obtained by looking at the sudo package:

$ apt-get download sudo
Get:1 http://mirror.cse.iitk.ac.in/ubuntu xenial-updates/main amd64 sudo amd64 1.8.16-0ubuntu1.1 [389 kB]
Fetched 389 kB in 0s (4,750 kB/s)
$ dpkg-deb --fsys-tarfile sudo*.deb | tar x ./etc/sudoers
$ cat etc/sudoers 
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

This is rather different from what you have. Restore /etc/sudoers to the default.

For excluding specific commands from requiring a password, see How do I run specific sudo commands without a password?

0

Edit your sudoers file using sudo visudo.

Find this line: Defaults env_reset and change it to this:

Defaults env_reset,timestamp_timeout=0

This forces sudo to ask for a password every time your run it.

  • 1
    Editing with this does not change anything still sudo does not prompt for password, and I would like to know how to exclude(or include) specific command or user. – bha159 Jun 17 '16 at 17:25
0

The OP doesn't mention which user is the admin user. Likely it is a created user account (and so this may not apply), but for other people who come across this thread I mention this: when using the current Ubuntu 16.04 AMI on AWS, the ubuntu user by default does not require a password for sudo so that cloud-init can use it to execute. This access is defined in /etc/sudoers.d/90-cloud-init-users, like so:

# User rules for ubuntu
ubuntu ALL=(ALL) NOPASSWD:ALL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.