The correct way to abort an operation from the sudo password prompt

sudo

Sometimes it amazes me the "little" things I don't know about Unix. For years now I have occasionally noted that I don't actually know how to deal with the sudo password prompt cleanly. Every once in a while I sudo something only to realize that I don't actually want to run the command at all. This happens rarely enough I always forget to ask but just often enough that I remember I still haven't learned the right way to abort.

Once sudo starts asking for a password it doesn't want to give up. You can't Ctrl+C it. If you give it the right password it will run the command that I've decided I want to abort. The only solution I have found is to give it wrong passwords until it gives up asking and falls back to an su prompt which actually listens to a Ctrl+C. This feels dirty to me. It's sad enough that I changed my mind about a command; not to be able to cancel it cleanly is just embarrassing.

What is the proper way to tell sudo to abort the attempt while at the password prompt?

Best Answer

What I usually do is Ctrl + Z to suspend the task, then kill %1 or even kill -9 %1 to stop:

> sudo ls
[sudo] password for user:

Ctrl + Z

[1]  +   512 Suspended                     sudo ls
> kill %1
[1]  + Suspended (tty output)        sudo ls
> kill -9 %1
[1]    Killed                        sudo ls

(In case you have more background tasks in your shell: The number you need to give after the percent sign is the one in brackets []).

Related Solutions

Sudo – How to Force Sudo to Prompt for a Password

sudo -k Will kill the timeout timestamp. You can even put the command afterwards, like sudo -k test_my_privileges.sh

From man sudo:

-K The -K (sure kill) option is like -k except that it removes the user's time stamp entirely and may not be used in conjunction with a command or other option. This option does not require a password.

-k When used by itself, the -k (kill) option to sudo invalidates the user's time stamp by setting the time on it to the Epoch. The next time sudo is run a password will be required. This option does not require a password and was added to allow a user to revoke sudo permissions from a .logout file.

You can also change it permanently. From man sudoers:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's timestamp will never expire. This can be used to allow users to create or delete their own timestamps via sudo -v and sudo -k respectively.

Sudo for users with empty passwords

I don't think this is possible because sudo will not know that a user doesn't have a password or that it's the empty string until it (sudo) presents the password, empty or otherwise, to the PAM module for validation. Therefore it will always need to request the password from the user, before proceeding.

Your only recourse here is to configure users that do not require the use of a password with the NOPASSWD option in your sudoers file. But this is highly insecure, and I'd recommend you seriously consider what your ultimate goal is here before proceeding with that method.

...so I don't care about security...

First set a "blank" password

This U&L Q&A titled: How do you create a user with no password? suggested using this method which worked for me.

$ sudo passwd --delete samtest
Removing password for user samtest.
passwd: Success

Now test it out

Now add a line like this to your /etc/sudoers file. NOTE: Always edit this file using sudo visudo.

samtest ALL=(ALL)       NOPASSWD: ALL

Now try logging in as user "samtest" without any password.

$ su - samtest
$

Now try using this account using sudo:

$ whoami
samtest

$ sudo echo

$