How to Change the Sudo Password Timeout in macOS Terminal Using sudoers

Working extensively within the macOS Terminal frequently requires administrative rights. By default, when you execute a command prepended with sudo, macOS prompts for your local account password. Once authenticated, the system caches your administrative credentials for a period of five minutes. If you run another administrative command after the five-minute grace period expires, you must type your password again. For developers and system administrators performing lengthy maintenance or complex deployment scripts, customising this credential timeout significantly enhances workflow efficiency.

Understanding the sudoers timestamp_timeout Directive

The duration for which macOS retains administrative authorization is governed by the timestamp_timeout setting inside the sudo security framework. This directive accepts several numeric configurations:

• Default (5 minutes): macOS resets the authorization counter after five consecutive minutes of terminal inactivity.
• Custom Duration (in minutes): For example, setting timestamp_timeout=30 grants a thirty-minute grace period between password prompts.
• Zero (0): Disables credential caching entirely, forcing macOS to require a password on every single sudo invocation for maximum security.
• Negative Value (-1): Retains authentication for the entire life of the active terminal session until the window or shell terminates.

Why You Should Never Edit /etc/sudoers Directly

Directly modifying the core /etc/sudoers file with standard text editors like Nano or Vim is strongly discouraged. A single syntax error, misplaced colon, or invalid whitespace will corrupt the sudoers policy database, locking you out of administrative privileges entirely. Always use the visudo utility, which parses and validates configuration syntax before saving files to disk.

Furthermore, on modern macOS versions (macOS Sonoma, Sequoia, and Ventura), Apple protects the primary /etc/sudoers file across operating system updates. The recommended best practice is creating an isolated override file inside the /etc/sudoers.d/ directory.

Step 1: Creating a Custom Sudoers Drop-In File

To safely apply your desired timeout without modifying Apple’s factory configuration files, create a designated drop-in snippet using visudo:

1. Open the Terminal application on your Mac (press Command + Space, type Terminal, and press Enter).
2. Launch visudo targeting a new drop-in file within the configuration directory:

   sudo visudo -f /etc/sudoers.d/custom_timeout

3. Enter your macOS administrator password when prompted.

Step 2: Adding the timestamp_timeout Directive

The visudo editor will open within the Terminal. (By default, macOS uses the Vim editor interface):

1. Press the i key to enter Insert mode.
2. Type the following line to set a custom timeout (for example, 20 minutes):

   Defaults timestamp_timeout=20

3. If you prefer to extend authentication for the entire terminal session, enter:

   Defaults timestamp_timeout=-1

4. If you want to enforce strict security by prompting on every command, enter:

   Defaults timestamp_timeout=0

5. Press Esc to exit Insert mode.
6. Type :wq and press Enter to save the file and exit.

visudo will automatically compile and verify the syntax. If no errors are detected, your override file is saved cleanly to /etc/sudoers.d/custom_timeout.

Step 3: Verifying and Testing the Configuration

To confirm that your custom rules are active without waiting for the clock to run down:

1. Audit your active sudoers privileges by running:

   sudo -V

2. Inspect the output lines. You will see Authentication timestamp timeout: 20.0 minutes confirming your configuration has been accepted.
3. You can manually clear your active cached sudo credentials at any time using:

   sudo -k

4. Run a benign root command such as sudo whoami. Type your password once, then run the command again a few minutes later to verify that the prompt no longer appears.

How to Revert Back to Factory Defaults

If you wish to restore the default five-minute timeout behaviour at any point in the future, simply remove the custom drop-in file using administrative privileges:

sudo rm /etc/sudoers.d/custom_timeout

The operating system will instantly revert to standard five-minute credential caching.

Frequently Asked Questions

Does this timeout apply across multiple Terminal tabs and windows?

By default, macOS maintains timestamp tickets per terminal tty device. This means authenticating in one terminal tab will not automatically grant access in a separate terminal window unless you specifically configure global ticket sharing (tty_tickets).

Can Touch ID for sudo be combined with a custom timeout?

Yes. If you have enabled Touch ID authentication for sudo via /etc/pam.d/sudo, your fingerprint authentication will abide by the exact same timestamp_timeout window.

What happens if I make a typo in visudo?

If visudo detects a syntax discrepancy upon saving, it halts and alerts you with a prompt: “What now?”. Pressing e allows you to re-edit the file and rectify the error before any invalid configuration is written to disk.