5

I want to know whether it is possible to indicate on the command-line (ideally in the prompt), whether sudo mode is on.

By sudo mode I mean that I have already entered my password correctly once in this shell session and it has not expired yet but is still cached.

In other words, can I tell somehow whether the sudo command I'm going to run will ask me for my password or will use the cached credentials?

Byte Commander
  • 107,489
  • You could check the clock via date as the cached credentials will expire after 15 mins... Related: http://askubuntu.com/questions/190311/sudo-credential-caching-on-by-default – Elder Geek Oct 18 '16 at 17:50
  • @ElderGeek That way I don't know whether credentials are cached at the moment or not though, just whether any sudo command was running within the last 15 minutes. – Byte Commander Oct 18 '16 at 17:54
  • Sorry, I meant check the clock when you first run a sudo command. Clearly they won't be cached anymore after 15 mins. expires. Sorry I don't have an answer for you. I suppose you could figure out something clever with a temporary prompt adjustment but it's hardly worth the trouble. You could just use sudo -i and you'd know you were superuser because your prompt would change to # from $ – Elder Geek Oct 18 '16 at 18:01

2 Answers2

4

For a long time, I have been using

sudo -S true < /dev/null 2> /dev/null

You might try that, but a recent update seems to have broken that since I now get a segmentation fault.

You might try sudo -n true 2> /dev/null (no -v). That seems to be working for me without renewing the timeout.

You can execute this in your prompt in various ways including something like:

PS1='\u:\w$(sudo -n true 2> /dev/null && echo " : sudo :") \$ '

This depends on the promptvars option which is enabled by default.

Note that once the prompt is issued, the indicator isn't updated again. So if the prompt sits there until the timeout expires, it may indicate that sudo is active even though it's expired.

Dennis Williamson
  • 3,512
  • Your initial suggestion of sudo -S true </dev/null 2> /dev/null behaved exactly as expected on a fresh Ubuntu 16.04 install. With luck, no future updates will induce the segmentation fault you noted. This is totally gonna fail at the worst possible moment, isn't it? – Cecil Curry Aug 18 '17 at 08:00
2

There is no command to directly show the remaining time for cached credentials, you would have to script it.

From https://unix.stackexchange.com/questions/115506/sudo-testing-for-credentials

sudo -nv 2> /dev/null

will give an exit value of 0 if the password is cached, you may be able to modify the script in that link or write your own.

Alternately the time stamps are stored in /var/lib/sudo so you could probably write a script to display or check the time stamp as well.

Community
  • 1
Panther
  • 102,067
  • 1
    But man sudo says that sudo -v also resets the cache timeout to 15 minutes again - which means repeatedly polling that command leads to the credentials to never expire, right? – Byte Commander Oct 18 '16 at 18:36
  • And /var/lib/sudo is empty for me, except for an empty subfolder lectured. There are no timestamps anywhere, even the modification and access times of those empty directories are months old. – Byte Commander Oct 18 '16 at 18:40
  • I am not sure where Ubuntu stores the time stamp in this case. I suggest you file a bug report / feature request with Ubuntu but they will likely push it upstream. – Panther Oct 18 '16 at 19:44
  • 1
    Since one has to activate one's "sudo power" to see if the credentials have been cached, and that would update the cache, you can never see "how much time is left". – waltinator Oct 18 '16 at 19:59
  • According to man sudo(5) "Time stamp file checks sudoers will check the ownership of its time stamp directory (/var/run/sudo/ts by default) " https://www.sudo.ws/man/sudoers.man.html or you can write a script to check the log file and determine the time stamp – Panther Oct 19 '16 at 16:27