31

My Problem

I would like to be able to run sudo commands on MacOS Sierra 10.12 without having to type a password.

What have I tried

I've read the following:

And changed the relevant part of my /etc/sudoers file to:

root ALL=(ALL) ALL
%admin  ALL=(ALL) NOPASSWD: ALL
%wheel ALL=(ALL) NOPASSWD: ALL
%wheel ALL=(ALL) NOPASSWD: ALL
%sudo   ALL=(ALL) NOPASSWD: ALL
adamatan ALL=(ALL) NOPASSWD: ALL

My local user id (whoami) is adamatan.

I'm still being asked to type a password every few minutes when calling sudo. Any idea what's wrong?

  • Does sudo -i work on Sierra? In El Cap it will switch you to root context and run login resource files for that session. (Will still need to be sudoers, so earlier effort not wasted). – FiddleDeDee Oct 27 '16 at 13:12
  • Works, but how does it solve the problem? – Adam Matan Oct 30 '16 at 10:15
  • 1
    I just recently upgraded to Sierra and ran into this. The default /etc/sudoers file has changed fairly radically from El Cap. There I just dropped a one line config file into the sudoers.d directory and it "just worked". Seems things have changed. I'll report back if I get anymore info. – Mark Edington Jul 12 '17 at 4:02
  • Maybe just execute one of the macOS root permissions exploits instead ;) – sudo Jul 19 '18 at 18:10
  • That defeats the whole point of sudo – Matthew Barclay Jun 14 '19 at 3:05
42

Open a terminal, run sudo visudo

Edit the line:

%admin ALL=(ALL) ALL

To say:

%admin ALL=(ALL) NOPASSWD: ALL

Now, you should now be able to run sudo without password.

| improve this answer | |
  • 2
    reboot it not really needed – RubenLaguna Dec 6 '18 at 13:18
5
root ALL=(ALL) ALL
%admin ALL=(ALL) NOPASSWD: ALL

stens ALL = (ALL) NOPASSWD: ALL # my userid is stens
| improve this answer | |
4

Better not to edit /etc/sudoers directly. Instead, the /etc/sudoers file does include a line:

## Read drop-in files from /private/etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /private/etc/sudoers.d

So better simply add an empty file under /private/etc/sudoers.d/mysudo and use visudo to fill it with a content like:

mylogin            ALL = (ALL) NOPASSWD: ALL

Remember to always run sudo visudo after creating the empty file under /private/etc/sudoers.d/ so that visudo also checks for syntax on that file, or else you might end up with a broken sudo configuration and the inability to run visudo to fix it.

You have been warned

| improve this answer | |
2

Try setting NOPASSWD on the root user. In /etc/sudoers

root            ALL = (ALL) NOPASSWD: ALL
| improve this answer | |
1

Execute the terminal whoami command to find your username (also known as ldapname).

> whoami

Chase that with executing the command below (be comfortable using VI/VIM before proceeding).

> sudo visudo -f /private/etc/sudoers.d/sudogo

NOTE1: The -f syntax will permit you to specify an alternate sudoers file location. With this option, visudo will edit (or check) the sudoers file of your choice, instead of the default, /etc/sudoers. The lock file used is the specified sudoers file with ".tmp" appended to it. In check-only mode only, the argument to -f may be -, indicating that sudoers will be read from the standard input.

NOTE2/WARNING: You could have created a file named "nopw" in place of sudogo. However, hackers are slick and will look for the letters "PW" (abbreviation for password). Feel free to change "sudogo" to something different, logical, and safe. Be aware that an extension was not added to the end of the file; It is not required.

An example is posted below. Activate insert mode with i, copy both lines posted below into the blank file. Substitute INSERT_USERNAME for ldapname. Hit escape, save and quit the file with :wq from command mode.

# user(s) below can can run any script on this machine
INSERT_USERNAME        ALL = (ALL) NOPASSWD: ALL

Execute sudo visudo (-f and path omitted) one final time. The command will open the sudoers file and check the changes. Proceed to type :q! to exit /etc/sudoers without saving changes.

> sudo visudo
| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .