On Mon, 2026-08-03 at 20:02 +1000, Sam K wrote:
> Many people have sudo configured with NOPASSWD, meaning a password is
> not prompted for. I assume this attack is targeting people with that
> configuration.
>
> Sam
Thank you Sam,
I suspect that most people stick with the default password setting,
which means they're prompted for the password every time they open a
terminal, but once they've entered it, they don't have to re-enter it
for 5 minutes while working within that terminal.
$ man sudo | grep timestamp_timeout -A1 -B2
Security policies may support credential caching to allow the user
to run sudo again for a period of time without requiring authentication. By
default, the sudoers policy caches cre‐
dentials on a per-terminal basis for 5 minutes. See the
timestamp_type and timestamp_timeout options in sudoers(5) for more
information. By running sudo with the -v option, a user can
update the cached credentials without running a command.
$ man sudoers | grep 'Some systems' -A2 -B1
Some systems with graphical desktop environments allow unprivileged
users to change the system clock. Since sudoers relies on the system clock for
time stamp validation, it may be pos‐
sible on such systems for a user to run sudo for longer than
timestamp_timeout by setting the clock back. To combat this, sudoers uses a
monotonic clock (which never moves backwards)
for its time stamps if the system supports it.
$ man sudoers | grep 'timestamp_type sudoers' -A22 -B1
timestamp_type sudoers uses per-user time stamp files for
credential caching. The timestamp_type option can be used to specify the type
of time stamp record used. It has the fol‐
lowing possible values:
global A single time stamp record is used for all
of a user's login sessions, regardless of the terminal or parent process ID.
An additional record is used to seri‐
alize password prompts when sudo is used
multiple times in a pipeline, but this does not affect authentication.
ppid A single time stamp record is used for
all processes with the same parent process ID (usually the shell). Commands
run from the same shell (or other common
parent process) will not require a
password for timestamp_timeout minutes (5 by default). Commands run via sudo
with a different parent process ID, for exam‐
ple from a shell script, will be
authenticated separately.
tty One time stamp record is used for each
terminal, which means that a user's login sessions are authenticated
separately. If no terminal is present, the behav‐
ior is the same as ppid. Commands run
from the same terminal will not require a password for timestamp_timeout
minutes (5 by default).
kernel The time stamp is stored in the kernel as
an attribute of the terminal device. If no terminal is present, the
behavior is the same as ppid. Negative
timestamp_timeout values are not supported
and positive values are limited to a maximum of 60 minutes. This is currently
only supported on OpenBSD.
The default value is tty.
This setting is only supported by version 1.8.21
or higher.
timestampdir The directory in which sudo stores its time stamp
files. This directory should be cleared when the system reboots. The default
is /run/sudo/ts.
timestampowner The owner of the lecture status directory, time
stamp directory and all files stored therein. The default is root.
FWIW I just shortened this to 1 minute.
$ sudo EDITOR=xed visudo
[snip]
##
## Defaults specification
##
Defaults timestamp_timeout=1
[snip]
Regards,
Ralf
