The dangers of sudo timeout¶
Ubuntu is configured by default to cache the user’s credentials for a couple
minutes after a successful use of
sudo. This is very comfortable. When you
enter a couple commands in succession, you do not have to enter the password
every single time. Take the following:
sudo apt-get update sudo apt-get upgrade sudo apt-get dist-upgrade
sudo authentication would not be cached, you would have to enter
your password three times.
One should be able to protect themselves from this. You can do this in layers.
sudotimeout completely. This can be done by adding the following line to
Instead you can use
sudo -ito obtain a
rootlogin shell to type all the commands without
sudo. This is more secure than using
sudo -ssince that uses the
rootinstead of your own. An attack I just showed you here should be possible against the use of
sudo -sas well. Just wait until the user ID changes to 0 and launch your code.
Do not copy & paste code from websites directly into your shell. Paste it into an editor window instead and look what it does. Alternatively you could type the commands yourself as well.
Regularly scanning files like
.bashrc for those kind of things are probably
not really doing any good. The attacker would just remove all the traces once
the attack is launched. There are so many attack vectors, cleaning up is
probably not worth the effort. Rather invest in security up front by being