Bug 112 – sudo bash results in auto password authentication

Bug 112 - sudo bash results in auto password authentication


Summary:	sudo bash results in auto password authentication

Status:	RESOLVED INVALID

Product:	Sudo
Classification:	Unclassified
Component:	Sudo
Version:	1.6.6
Hardware:	Macintosh MacOS X

Importance:	normal security
Assigned To:	Todd C. Miller

URL:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2003-05-08 22:15 MDT by Mark Webster
Modified:	2003-05-09 03:11 MDT (History)
CC List:	0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Mark Webster 2003-05-08 22:15:40 MDT

Running MacOS X.2.6 server

opening a terminal and typing sudo bash (as the admin account, not root)
results in a bash shell as root access. Can do anything, no password needed.

Also, exiting that shell results in sudo being allowed in the original shell without any 
further password entry.

Comment 1 Todd C. Miller 2003-05-08 23:11:08 MDT

If you run a shell with sudo then of course you can do anything.  The whole point of sudo is that you don't *need* (or want) to run a root shell.  Instead you run individual commands as root.  As for your second issue, I think you are getting confused by sudo's timestamp feature.  By default sudo will not ask for a password if you have run sudo within the last 5 minutes.  If you don't like this it is configurable...