Sudo password timeout

[AnimeFreak]

I recently switched from ubuntu..


Is there a password timeout for sudo.


If so, I would like to have sudo ask for the password every single time.


How do I do this.


what command do I use in the sudoers file.


Also, where do I place the command in the sudoers file.



NOTE: I already have sudo enabled.




Thanks,

AnimeFreak

[madmix]

Hi AnimeFreak,

As root enter visudo, look for the section of Defaults and add the following line:

Defaults    timestamp_timeout = 0

Then quit VI (Esc followed by :wq).

[AnimeFreak]

I have one more question.


When I have to authenticate as root to do things like mange users and groups or the firewall with the Fedora Firewall GUI, it asks for the root password, I enter it, and manage the users and groups, or the firewall.

A couple of minutes later I do the same thing but am not required to enter the root users password.



How can I make it so that I am required to enter root's password every time.

[madmix]

Enter the following commands:

su -
cd /etc/pam.d
sed -i.bkp 's/^auth.\+pam_timestamp.so$/& timestamp_timeout=0/' config-util

A number of graphical administrative tools provide users with elevated privileges for up to five minutes using the pam_timestamp.so module. The sed command above specifies a period of 0 seconds for which the timestamp is valid. The file modified, config-util, is included in the PAM configuration files related to these graphical tools which intend to cache successful authentication attempts.

[AnimeFreak]

Originally Posted by madmix

Enter the following commands:

sed -i.bkp 's/^auth.\+pam_timestamp.so$/& timestamp_timeout=0/' config-util

Is all of the above code one command?

[madmix]

Yeah, each line is one command. You can copy and paste it.

sed -i.bkp 's/^auth.\+pam_timestamp.so$/& timestamp_timeout=0/' config-util

This sed line makes a backup of file config-util, copying it to a file with prefix .bkp (config-util.bkp) and then updates the original file in place -- this is the -i switch. The one-liner sed script uses a substitution command, s/what_to_look_for/replacement/, to update a line whose first characters are auth and last ones pam_timestamp.so. When it finds such a line it appends timestamp_timeout=0 to it, which is the option we want to modify from the default of 300.

You can do it by hand if you wish. It is a small modification.

[AnimeFreak]

thanks for the info.

[madmix]

You're welcome.