Home / ubuntu / Questions / 139723
Accepted
Rahul Virpara
Asked: 2012-05-21 01:27:20 +0800 CST

sudo does not ask for password [duplicate]

  • 772

Whenever I issue command sudo apt-get install foo it does not ask for password. is it because of user groups?

How to make it prompt for password?

Edit: My sudoers file 

apple@Ascension:~$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
ALL ALL=(ALL) NOPASSWD:ALL
sudo

1 Answers

  1. Best Answer

    With the command sudo visudo you can see and edit, the sudo configuration, for example :

    # User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Group without password
%nopwd  ALL=NOPASSWD: ALL

    Your current user is probably member of a privileged group that enables him to enter sudo commands without password. In this example members of admin and sudo group can issue any command with sudo, but are prompted with a password ; members of the nopwd group are not prompted with a password.

    Note that the declaration order is relevant for users belonging to multiple groups. Unintuitively, the LAST matching group wins !

    In order to require a password, you can add the PASSWD: /usr/bin/apt-get command specification in file /etc/sudoers ; note that you probably want to allow specific commands with no password, and keep every other command with a password. An example explicitely requesting a password for apt-get:

    %users  ALL=NOPASSWD: /sbin/reboot, PASSWD: /usr/bin/apt-get

    Note that you can personnalize sudo with a much finer granularity than allow all commands like in my first example (doc ubuntu fr)(doc ubuntu en).

    • 17