0

I've been using Lion since its release, and I noticed today, for the first time, that Terminal did not prompt me for a password when I typed in a sudo command, if I close and reopen Terminal within the five-minute window, but wait longer than five minutes after reopening the application to enter another sudo command.

Is it being cached somewhere as a result of Lion's new "remember the state of the application" feature? Can I turn off this setting? It seems rather insecure.

I've also tried using the Command + Option + Q combination, as well as exiting Terminal before quitting the application, to no avail (also within the five minute timeout window).

For the record, I don't recall seeing this behaviour before I updated to 10.7.1, but I may be wrong.

Can anyone else replicate this for me and confirm my suspicion, before I log a bug with Apple?

EDIT: Apparently my question isn't clear. I want to know if this is normal, or a bug:

  • Issue sudo command. I am prompted for a password.

  • Close Terminal before sudo timeout takes effect (within five minutes).

  • Open Terminal again, and wait more than five minutes before issuing sudo again.

  • Issue sudo command. I am not prompted for a password.

Improve this question

2 Answers 2

Reset to default
6

This is normal, and an inherent consequence of the way sudo handles its 5-minute don't-need-to-reauthenticate window. When you authenticate to sudo, it records your account as having authenticated. Because the authentication is tied to your account (not a Terminal session or something like that), it's still valid if you quit & reopen Terminal, log out & back in, or even switch to a different session type (e.g. console login vs. SSH session vs. cron job running as your user ID, etc). I'm not certain offhand if it survives a reboot -- if not, it's because there's a step in the system startup process that wipes the timestamp files.

BTW, you can clear your own timestamp file with sudo -K.

Improve this answer
3
  • It has been this way since at least the first beta version of OSX I have used..
    – cftarnas
    Commented Aug 24, 2011 at 17:18
  • @cftarnas: even longer than that, since OS X's implementation of sudo came from earlier unixes which worked the same way.
    – Gordon Davisson
    Commented Aug 24, 2011 at 18:21
  • @Gordon: I would suspect so! More recent Linux distros that I have used like RHEL require the password at every invocation, but that could be that I've only been using the enterprise linux distros for the last 10 years or so.
    – cftarnas
    Commented Aug 24, 2011 at 18:26
3

By default, sudo retains authentication state for 5 minutes (this is not new to Lion). This default timeout can be controlled with the timestamp_timeout setting in /etc/sudoers (use visudo to edit). See man 5 sudoers for more.

It can also be reset individually by removing the timestamp directory for the user, e.g. sudo rmdir /var/db/sudo/username

This is not related to the application state feature introduced in Lion (controllable via System Preferences -> General -> Restore windows when quitting and re-opening apps).

Improve this answer
5
  • I'm not asking about the default timeout. I'm asking whether it's normal that the timeout seems to stop until another sudo is performed after opening Terminal.
    – user479
    Commented Aug 20, 2011 at 18:12
  • Ah, I missed that part. The timeout is actually measured when sudo runs, based on the difference between the current time and the timestamp on the time stamp directory (/var/db/sudo/username). So unless your clock stops ticking, the timeout should never pause. It does however also get refreshed when another sudo is executed from the same user, so check for that (by monitoring the timestamp directory to see if the timestamp gets refreshed when you don't use sudo yourself). Good luck in hunting that down :)
    – Ingmar Hupp
    Commented Aug 20, 2011 at 18:21
  • That's the behaviour I'm seeing: it seems to pause and only starts going once someone issues another sudo, whether me or another user. So is it a bug on mine or everyone's computer?
    – user479
    Commented Aug 20, 2011 at 18:25
  • Cannot reproduce this here (Lion 10.7.1), seems to work as intended: I run sudo ls, quit Terminal, wait 6 minutes and sudo asks for a password again, as expected. As I said, the most likely cause is another process refreshing the timeout by running sudo as the same user. To find out which process, run sudo fs_usage -wf filesys|grep /var/db/sudo (while not actively using sudo anywhere else).
    – Ingmar Hupp
    Commented Aug 20, 2011 at 19:13
  • If you open Terminal within the five minute window and then wait six minutes after it is open, can you repeat the behaviour?
    – user479
    Commented Aug 20, 2011 at 20:46

You must log in to answer this question.