Sudo is Not Prompting For a Password When Re-executed Second Time

I use sudo to provide permissions and command execution rights to other users under UNIX and Linux operating systems. However, I noticed something strange about sudo. When executing sudo, it will prompt for the user’s password the first time, but sudo no longer requires a password anymore when re-executing it. Why? Is this is a security risk?

The sudo tool records the timestamp by creating a file, when it is executed the first time, sudo won’t need a password if the timestamp has not timed out. The default time out value is 900 seconds (15 minutes).

timestamp_timeout Option

The timestamp_timeout defines the number of minutes that can elapse before sudo will ask for a password again. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s timestamp will never expire. Edit /etc/sudoers, enter:
# vi /etc/sudoers
You can also use the visudo command, which edits the sudoers file in a safe fashion:
# visudo
Set timestamp_timeout as per your requirmehnt or 0 so that it will always prompt for a password:
timestamp_timeout 0
Save and close the file.

sudo -k command line option

The -k option allow users to create or delete their own timestamps via sudo -v and sudo -k respectively. Run sudo -k to invalidate the timestamp after executing sudo command:
$ sudo -k

passwd_timeout Option

The passwd_timeout defines number of minutes before the sudo password prompt times out. The default is 5, set this to 0 for no password timeout. Edit /etc/sudoers, enter:
passwd_timeout 2

Posted by: SXI ADMIN

The author is the creator of SXI LLC and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.