I was reading the this question over on Ask Ubuntu and they suggest adding the following line to etc/sudoers so that you're not prompted to enter your password each time you run sudo


Is this a security risk and if so, what are some ways people can exploit this?

  • 2
    Yes, it's a security risk, but if somebody gains access to an account of the admin group, you're already in trouble. It's rather easy to create an alias that executes malicious code that will be executed the instead of the actual sudo command.
    – Dennis
    Jan 9, 2016 at 6:23
  • 2
    Does this answer your question? How secure is NOPASSWD in passwordless sudo mode? Sep 6, 2020 at 5:38

1 Answer 1


Yes, it's a risk. Anyone who touches your keyboard can get root access by running sudo and not worrying about your password. Anyone who has an exploit that gets them userland access can instantly get root access using the sudo command. This reduces isolation and increases the effort to recover from an attack or intrusion.

  • 2
    Good thing this is isn't done by default on the world's most used VPS....... oh, wait... Jan 9, 2016 at 9:30
  • @BillyC. which VPS is that?
    – jwerre
    Aug 17, 2017 at 23:05
  • Amazon..... EC2....... Aug 17, 2017 at 23:07
  • Do we know if AWS provided any justification for this? They don't take security lightly so I suppose there must be some reason they've done it this way.. Sep 24, 2022 at 4:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .