Home / ubuntu / Questions / 25591
Accepted
belacqua
Asked: 2011-02-10 23:37:17 +0800 CST

Why does sudo ask for a password in window after I've just authenticated in a different one?

  • 772

If I am using the command line in xterm, gnome-terminal, etc., I can keep sudo from re-prompting for a password, within some limits, or I can disable it.

As a compromise between usability and security, I usually just want this re-querying wait-time lengthened.

By default, there is only a 15 minute grace-period after entering a sudo password before it prompts for it again. To change this to 45 minutes, I can edit /etc/sudoers, and set timestamp_timeout to the waiting period I want (in minutes) .

sudoers file

If I am within the same terminal session, and start a new shell (typing in csh or bash) the wait period is respected.

But if I go to another window to access the command line there, it will immediately ask for my password if I try to sudo.

Within the same pseudoterminal session (pts) (for example, if I spawn a new shell inside the same gnome-terminal window), the timeout is respected.

If I launch a new xterm, gnome-terminal, etc., I must enter credentials again.

Despite being the only user active on my home system (a single-user system), etc., sudo doesn't trust that all of my pts entries are from the same user: 

~/pseudoland$ w
 01:27:39 up 1 day, 15:03,  7 users,  load average: 0.32, 0.71, 0.77
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
jgb    tty1                      23:56    1:30m  0.55s  0.51s -bash
jgb    tty7     :0               Tue10   39:03m  2:28m  0.76s gnome-session
root     pts/1    :0.0             00:30   56:23   0.01s  0.01s /bin/bash
jgb    pts/3    :0.0             01:16    0.00s  0.59s  3.22s gnome-terminal
jgb    pts/4    :0.0             01:27   26.00s  0.23s  0.23s /bin/bash
jgb    pts/5    :0.0             01:17    9:26   0.23s  0.23s bash

Is there a way to tell sudo that it should regard all the windows I open as coming from the same user, and to not ask again for my password if the last sudo timer hasn't expired?

gnome-terminal

1 Answers

  1. Best Answer

    The grace period is controlled by what sudo calls a 'ticket'. When you authenticate with sudo, it creates this ticket with a certain timestamp that basically says when the authentication should expire.

    By default (this is set when the package is compiled), this timeout is, as you've found, per tty. This is a feature of sudo called 'tty_tickets'. Basically this means that, instead of creating one lock per user, sudo creates one lock per tty instead.

    In order to revert back to the old behaviour and override the default, you need to edit /etc/sudoers. Find the "Defaults" line, which you already edited to change the timeout, and append ,!tty_tickets to it. This will turn off the tty_tickets feature and give you the behaviour you want.

    • 13