I managed to perform the command: "sudo apt-get install" without being asked for a password

[frostbeule]

I wanted to install the package "gconf" so i went to a terminal and enterd:
"sudo apt-get install gconf"
I expected a question for a password (as usual) and was really suprised that it didnt ask me but started to download and install the package at once.
I tried the same command a few minutes later (as i just had logged in and though the rights for sudo could have come from there) and it still worked and didnt ask me for a password.
After testing i found also "sudo apt-get remove gconf" working fine without entering a password.

I belive this is a security bug as anyone having physical access to the computer could remove all programs without being asked for a password.

and before anyone asks: I verifyed that i didnt open a root-terminal.

[frostbeule (msschuh)]

just got asked if i entered the sudo-password somewhere else so i answer this question here already: it worked 20min later, too - no sudo-password is activated that long. And i didnt enter any sudo-password - all i did was reporting the bug here and in a forum (www.ubuntu-forum.de) and it worked after that, too.

[frostbeule (msschuh)]

after i did a not-sudo command it doesnt work anymore, still i can prove the events with a screenshot and a log of the session in the terminal.

My current theory about this is:
If you log in and immedately oen a terminal you dont have to enter the sudo-password there if you do something that needs sudo-rights. These sudo-rights stay too long tho (longer than 20min at least) or even stay as long as you dont do any command that doesnt need sudo-rights.

[Martin Pitt (pitti)]

I assume that you get the same behaviour for other commands as well? (like 'sudo true', which does nothing, but is a nice way of checking for the password). Does it ask for a password again after you did 'sudo -k'? Can you please show me your /etc/sudoers by doing

  sudo cat /etc/sudoers

and copy&pasting the result here?

Thank you!

[frostbeule (msschuh)]

malte@Malte-PC:~$ sudo cat /etc/sudoers
# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults

Defaults !lecture,tty_tickets,!fqdn

# User privilege specification
root ALL=(ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

_________________________________________________________

Yes every sudo-command was working without entering the password.
today i failed to reproduce the bug - this is confusing me (Yet the screenshot posted above shows that i didnt invent this, the line "Passwort" (=Password) is missing as you see).

[Martin Pitt (pitti)]

OK, leaving this open until you can reproduce it (I can't).

[kko (kko)]

Hello.

I have recently studied the effects of some 'sudo'-related bugs. Have you been able to reproduce this lately?

Are you completely sure that you had not given your password to any other application before? (You didn't e.g. change your computer's clock or use some automated program to install a new application, or do anything that could require you to write your password? Maybe used Synaptic or another application installer or give your sudo password in an earlier terminal instance?)

The reason I ask: If you had given your password somewhere, anywhere, during the 15 minutes prior to this, the mechanism caching the sudo tty_tickets could easily be responsible for this behaviour.

Also, you mention 20 minutes above, but you also mention trying this a few times with a few minutes in between. (Doing this a few times with a few minutes in between renews the timestamp each time.) If you're sure that you had 20 minutes time between two consecutive attempts (>15 min), or you haven't changed your computer's clock, this may then be something different.

[frostbeule (msschuh)]

this is a very late response, i know, but i have been able to reproduce it lately (on a clean, new feisty)

so what did i do and how did i do it?

firstly i created a shortcut to the gnome-terminal
then i shut my computer down.
after this i rememberd i still needed to do something and therefore i started it again. ~5 seconds after i logged in i started the gnome-terminal. there i performed a sudo command and I was not asked for a password.

my theory about this is now: because i just logged in, feisty assumed that it is highly unlikely that someone else but me performes the command and therefore countes the login as authentification for sudo as well.

[Launchpad Janitor (janitor)]

[Expired for sudo (Ubuntu) because there has been no activity for 60 days.]