Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I've been using Lion since its release, and I noticed today, for the first time, that Terminal did not prompt me for a password when I typed in a sudo command, if I close and reopen Terminal within the five-minute window, but wait longer than five minutes after reopening the application to enter another sudo command.

Is it being cached somewhere as a result of Lion's new "remember the state of the application" feature? Can I turn off this setting? It seems rather insecure.

I've also tried using the Command + Option + Q combination, as well as exiting Terminal before quitting the application, to no avail (also within the five minute timeout window).

For the record, I don't recall seeing this behaviour before I updated to 10.7.1, but I may be wrong.

Can anyone else replicate this for me and confirm my suspicion, before I log a bug with Apple?


EDIT: Apparently my question isn't clear. I want to know if this is normal, or a bug:

  • Issue sudo command. I am prompted for a password.

  • Close Terminal before sudo timeout takes effect (within five minutes).

  • Open Terminal again, and wait more than five minutes before issuing sudo again.

  • Issue sudo command. I am not prompted for a password.

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

This is normal, and an inherent consequence of the way sudo handles its 5-minute don't-need-to-reauthenticate window. When you authenticate to sudo, it records your account as having authenticated. Because the authentication is tied to your account (not a Terminal session or something like that), it's still valid if you quit & reopen Terminal, log out & back in, or even switch to a different session type (e.g. console login vs. SSH session vs. cron job running as your user ID, etc). I'm not certain offhand if it survives a reboot -- if not, it's because there's a step in the system startup process that wipes the timestamp files.

BTW, you can clear your own timestamp file with sudo -K.

share|improve this answer
    
Thanks for the explanation. I'm accepting your answer. –  user479 Aug 21 '11 at 1:58
    
It has been this way since at least the first beta version of OSX I have used.. –  cftarnas Aug 24 '11 at 17:18
    
@cftarnas: even longer than that, since OS X's implementation of sudo came from earlier unixes which worked the same way. –  Gordon Davisson Aug 24 '11 at 18:21
    
@Gordon: I would suspect so! More recent Linux distros that I have used like RHEL require the password at every invocation, but that could be that I've only been using the enterprise linux distros for the last 10 years or so. –  cftarnas Aug 24 '11 at 18:26
add comment

By default, sudo retains authentication state for 5 minutes (this is not new to Lion). This default timeout can be controlled with the timestamp_timeout setting in /etc/sudoers (use visudo to edit). See man 5 sudoers for more.

It can also be reset individually by removing the timestamp directory for the user, e.g. sudo rmdir /var/db/sudo/username

This is not related to the application state feature introduced in Lion (controllable via System Preferences -> General -> Restore windows when quitting and re-opening apps).

share|improve this answer
    
I'm not asking about the default timeout. I'm asking whether it's normal that the timeout seems to stop until another sudo is performed after opening Terminal. –  user479 Aug 20 '11 at 18:12
    
Ah, I missed that part. The timeout is actually measured when sudo runs, based on the difference between the current time and the timestamp on the time stamp directory (/var/db/sudo/username). So unless your clock stops ticking, the timeout should never pause. It does however also get refreshed when another sudo is executed from the same user, so check for that (by monitoring the timestamp directory to see if the timestamp gets refreshed when you don't use sudo yourself). Good luck in hunting that down :) –  Ingmar Hupp Aug 20 '11 at 18:21
    
That's the behaviour I'm seeing: it seems to pause and only starts going once someone issues another sudo, whether me or another user. So is it a bug on mine or everyone's computer? –  user479 Aug 20 '11 at 18:25
    
Cannot reproduce this here (Lion 10.7.1), seems to work as intended: I run sudo ls, quit Terminal, wait 6 minutes and sudo asks for a password again, as expected. As I said, the most likely cause is another process refreshing the timeout by running sudo as the same user. To find out which process, run sudo fs_usage -wf filesys|grep /var/db/sudo (while not actively using sudo anywhere else). –  Ingmar Hupp Aug 20 '11 at 19:13
    
If you open Terminal within the five minute window and then wait six minutes after it is open, can you repeat the behaviour? –  user479 Aug 20 '11 at 20:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.