0 Making sudo Safer for Shutdown.md

Making sudo Safer for Shutdown: Defaults!/usr/sbin/shutdown timestamp_timeout=0

If you manage a Linux system, you may sometimes allow users to run specific administrative commands with sudo. One common example is letting trusted users execute the shutdown command: /usr/sbin/shutdown. But there’s a subtle security detail to consider—how long sudo remembers (or “caches”) a user’s password after they authenticate.

What the line means

Defaults!/usr/sbin/shutdown timestamp_timeout=0

This is a directive for the sudoers configuration (usually managed via visudo). It does three things:

1. Defaults!<command>: The exclamation mark after Defaults targets settings to a specific command. Here, the command is /usr/sbin/shutdown.
2. /usr/sbin/shutdown: This is the full path to the system shutdown tool.
3. timestamp_timeout=0: This sets the sudo authentication cache timeout to zero minutes—i.e., no caching.

Why this is useful

By default, after you enter your password for sudo, you typically won’t be asked again for a short period (often 5 minutes). That convenience can be risky for powerful commands like shutdown or reboot: a stray terminal, a reused shell, or someone walking up to an unlocked session could trigger an unintended shutdown.

Setting timestamp_timeout=0 for just the shutdown command ensures:

• Password required every time you run /usr/sbin/shutdown with sudo.
• Reduced risk of accidental or unauthorized shutdowns if a session is left unlocked.
• Granular control: other commands can still use the normal timeout; only shutdown is tightened.

Where to put it

Use visudo (which checks syntax and prevents corrupting your config):

sudo visudo

Then add the line:

Defaults!/usr/sbin/shutdown timestamp_timeout=0

Make sure the path (/usr/sbin/shutdown) matches your system. You can verify with:

which shutdown
# or
command -v shutdown

How it behaves

After adding the directive:

• Running sudo /usr/sbin/shutdown -h now (or similar) will always prompt for your password.
• Immediately running it again will prompt again, because the timestamp isn’t cached for this command.
• Other sudo commands (e.g., sudo ls /root) will follow whatever global timeout you’ve configured.

Variations and tips

• If you also use /sbin/shutdown on some systems, repeat the directive with that path.
• You can apply the same pattern to other sensitive commands (e.g., /sbin/reboot, package managers, or service controllers).
• Combine with least-privilege rules: allow only the commands users truly need, and lock down everything else.

Bottom line

The line Defaults!/usr/sbin/shutdown timestamp_timeout=0 is a small, targeted hardening step. It keeps shutdowns deliberate by requiring a password every single time, without sacrificing convenience for the rest of your sudo workflow.