sharland
Posts: 8
Joined: Thu Aug 14, 2014 8:19 pm
Location: Oxford
Contact: Website

Always request password when using sudo

Sun Dec 25, 2016 11:31 pm

Hi,

I would like to setup the default pi account in such a way that it still has the ability to use sudo for installing packages but each time sudo is used it automatically asks for a password. This is for my young son's first Pi where I would like him to learn about using sudo but rely on me to input the password for him.

I have tried removing pi from sudo and add groups (which worked) but after doing so (and rebooting) I can still execute sudo commands. I have setup another account just for myself which I have been able to grant sudo rights to.

How can I set this up?

thanks
brian

User avatar
kusti8
Posts: 3439
Joined: Sat Dec 21, 2013 5:29 pm
Location: USA

Re: Always request password when using sudo

Sun Dec 25, 2016 11:47 pm

https://ubuntuforums.org/showthread.php?t=1672593
In the sudo file also there is a line that says no password which you have to delete. I don't remember if it is the sudo file or in /etc/sudoers.d/
There are 10 types of people: those who understand binary and those who don't.

gkreidl
Posts: 5998
Joined: Thu Jan 26, 2012 1:07 pm
Location: Germany

Re: Always request password when using sudo

Mon Dec 26, 2016 6:30 am

sudo nano /etc/sudoers.d/010_pi-nopasswd
There's only one line:
pi ALL=(ALL) NOPASSWD: ALL
Change it to
pi ALL=(ALL) PASSWD: ALL
Minimal Kiosk Browser (kweb)
Slim, fast webkit browser with support for audio+video+playlists+youtube+pdf+download
Optional fullscreen kiosk mode and command interface for embedded applications
Includes omxplayerGUI, an X front end for omxplayer

sharland
Posts: 8
Joined: Thu Aug 14, 2014 8:19 pm
Location: Oxford
Contact: Website

Re: Always request password when using sudo

Wed Dec 28, 2016 8:34 pm

excellent - that seems to have done the trick - thank you

normanp
Posts: 8
Joined: Sat Jan 14, 2012 7:23 pm

Re: Always request password when using sudo

Sat May 13, 2017 10:04 am

gkreidl wrote:sudo nano /etc/sudoers.d/010_pi-nopasswd
There's only one line:
pi ALL=(ALL) NOPASSWD: ALL
Change it to
pi ALL=(ALL) PASSWD: ALL
Saved me - thanks! gkreidl - is there any way that you could put this in either the pi faq or documentation, or maybe suggest it as an extra item in raspi-config? It seems to me a very basic requirement that a sudo use needs a password!
This info was really hard to find with lots of sites giving inappropriate advice about changing the sudoers file.
Thanks again

User avatar
emgi
Posts: 357
Joined: Thu Nov 07, 2013 4:08 pm
Location: NL

Re: Always request password when using sudo

Sat May 13, 2017 10:38 am

This can also be used to give other users the privilege of not having to enter passwords over and over.
Poorly documented but it works:

Code: Select all

#cat /etc/sudoers.d/020_leo-nopasswd
leo ALL=(ALL) NOPASSWD: ALL
This obviously allows nopassword for the user leo.
I just put it in the directory with vi since I couldn't find a way to do this cleanly, i.e. with visudo.

normanp
Posts: 8
Joined: Sat Jan 14, 2012 7:23 pm

Re: Always request password when using sudo

Sat May 13, 2017 10:52 am

Is the filename significant (020_leo-nopasswd)?

User avatar
emgi
Posts: 357
Joined: Thu Nov 07, 2013 4:08 pm
Location: NL

Re: Always request password when using sudo

Sat May 13, 2017 3:29 pm

Probably not. :lol:
Should be tested.

dsedv
Posts: 1
Joined: Mon Aug 27, 2018 12:40 pm

Re: Always request password when using sudo

Mon Aug 27, 2018 12:54 pm

The README in /etc/sudoers.d/explains that any file will be read that does not end in a tilde "~" oder contains a dot "." The mode should be 0440.

Return to “Beginners”