Return
-
Title
sudo password timeout does not expire after logout -
Description
The user using a sudo command keeps the password for 5 minutes, which is the standard, however when the user makes a sudo command and logs out of the server and logs back in before the 5 minutes expiration the system does not prompt the user for a password. -
Cause
Sudo's per-user credential cache timestamp file records the tty on which the user authenticated (unless the tty_tickets option is disabled, in which case there is a single per-user timestamp across all ttys). So if the user logs out and then logs back in and the login session uses the same tty on which the user originally authenticated, then the cached credentials are taken to be valid. -
Resolution
WORKAROUND 1:You can prevent sudo from remembering your password with a sudoers entry: Defaults timestamp_timeout = 0. You may change 0 to any number representing the minutes you may want your password to be “remembered”, or let in 0 so you will need to type your password each time you type sudo
WORKAROUND 2:Write a logout shell script and include "sudo -K" to clear the cache on logout.
Disclaimer:Script writing and base sudo configurations and settings are outside the scope of Technical Support. If you need assistance with these task please contact your Account Rep or our Professional Services Team. For information on how to contact them please visit https://support.oneidentity.com/professional-services-product-select