How can I make sudo forget the password automatically after one command?

Question

My problem is the following: I want to edit a file that is only readable by root. That's why I use

sudo vim ~/thefile

I could type

sudo -K

after exiting vim, but I was hoping that there's an option or something that makes sudo forget the password automatically. Of course I thought about editing the sudoers file and setting the timeout to 0, but I don't want to change the settings in general. I also found nothing in the manpage...

Is there a way to do this?

If interesting: I'm using Ubuntu 12.04 and bash.

As a workaround, try function sudok () { sudo "$@"; sudo -K; } — Mark Plotnick, Feb 25 '15 at 16:37
Seems to work just fine for me!! Where would I save this to make it last? — caligula, Feb 25 '15 at 16:53
You should put that function into ~/.bashrc or ~/.bash_aliases. This will make it only available to your user account which sounds like what you want. If you want every user on the system to have access to sudok then put it in /etc/bash.bashrc. — EarlCrapstone, Feb 25 '15 at 18:02
Hey, thanks for that information. I forgot about the bashrc! Now how should I get this thread solved? Mark Plotnick should write this stuff here as an answer, shouldn't he? — caligula, Feb 25 '15 at 20:35
Use sudoedit instead of sudo vim. You don't need the editor to run as root. — Gilles 'SO- stop being evil', Feb 25 '15 at 23:37
Thanks for the sudoedit hint, I didn't know of that. But I think in my case it doesn't fit: I don't want any temporary copies to be created that are readable by the current user. — caligula, Feb 26 '15 at 12:48

score 6 · Accepted Answer · answered Feb 25 '15 at 22:27

There isn't an option to sudo that will do exactly what you want, but you can make a shell function that will create a new command sudok, which will run the sudo command and then have sudo remove its cached credentials.

function sudok () { sudo "$@"; sudo -K; }

Add that line to your ~/.bashrc or ~/.bash_profile to make it permanent.

score 6 · Answer 2 · answered Feb 25 '15 at 22:59

6

I'm pretty sure you just want sudo's little-k option,

sudo -k vim ~/thefile

which is documented to completely ignore your cachefile:

When used in conjunction with a command or an option that may require a password, this option will cause sudo to ignore the user's cached credentials. As a result, sudo will prompt for a password (if one is required by the security policy) and will not update the user's cached credentials.

answered Feb 25 '15 at 22:59

jthill

2,710

I tried to make this clear two times already: I don't want the shell to forget the credentials that are already there! I want the shell to forget the credentials (that I might have to type or that I might not need to type because they're already there) AFTER the actions in vim!! The answer of Mark_Plotnick does what I searched for... – caligula Feb 26 '15 at 12:39

score 2 · Answer 3 · edited Feb 25 '15 at 17:15

2

See man sudoers; a timestamp_timeout setting is described there. Set it to 0 to make sudo always prompt for a password.

edited Feb 25 '15 at 17:15

Cristian Ciupitu

2,510

answered Feb 25 '15 at 15:54

9000

1,639

2

That's what I meant by "I don't want to change the settings in general". I'd like to keep the timeout as it is! – caligula Feb 25 '15 at 15:58
Do you mean that you'd only want to change the setting for yourself? Or only for one particular command? I suppose there's sudoedit -k just for that; make a convenient alias. I suspect that you can even make calling sudo vim by a particular user to use timestamp_timeout = 0, but I did not try that and cannot guarantee it would work. – 9000 Feb 25 '15 at 16:49
I'm sorry for the bad english here, I'll try to make it clear: I want the shell to not remember my password after I exit vim. And I don't want to change user based settings like the timeout because I like the way everything works. So as you said, I'd like to change the settings for one command only... – caligula Feb 25 '15 at 17:06

How can I make sudo forget the password automatically after one command?

3 Answers3

Linked