Bugzilla – Bug 620
When using -S option, always read first line of stdin
Last modified: 2013-11-07 20:13:58 MST
When using sudo in a script with the -S option, it consumes the first line of input if the user is not already authenticated, but doesn't consume it if a password was not required. This can cause the password to be revealed if the command that sudo executes unexpectedly gets the password and publishes it somewhere.
If you always want sudo to consume the password you should use the -k option in conjunction with -S. For example, the following will always consume the password: $ echo test123 | sudo -Sk id Using the -k option along with a command should work for sudo versions 1.7.1 and higher.