Home / server / Questions / 1098981
Accepted
Dagelf
Asked: 2022-04-20 12:22:03 +0800 CST

Is it possible to lock sudo from the command line, without editing sudoers or logging out and back in?

  • 772

When you run sudo it won't ask a password for at least 5 minutes after you last ran it. You can change this timeout by adding Defaults timestamp_timeout=0 to sudoers with sudo visudo. This also instantly locks it.

My question is if there is a way to do it just once, and without visudo.

linux sudo

1 Answers

  1. Best Answer

    You can do this with the sudo -K or -k options:

    -K, --remove-timestamp
    Similar to the -k option, except that it removes the user's cached credentials entirely and may not be used in conjunction with a command or other option. This option does not require a password. Not all security policies support credential caching.

    -k, --reset-timestamp
    When used without a command, invalidates the user's cached credentials. In other words, the next time sudo is run a password will be required. This option does not require a password and was added to allow a user to revoke sudo permissions from a .logout file.

    When used in conjunction with a command or an option that may require a password, this option will cause sudo to ignore the user's cached credentials. As a result, sudo will prompt for a password (if one is required by the security policy) and will not update the user's cached credentials.

    Not all security policies support credential caching.

    • 11