Why does Truecrypt ask for administrator password?

Question

When I login on my Ubuntu system a script will mount a truecrypt container. To decrypt the container I have of course to enter the decryption password. But Truecrypt also asks for my "administrator password". Why does Truecrypt ask for my administrator password and how can I disable this?

This is the script which runs on startup:

#!/bin/sh -e
/usr/bin/truecrypt /media/windows/data.tc /media/data
/usr/bin/dropbox start

/media/windows is a NTFS partition. /media/data is writable by the user.

Solution 1

TrueCrypt asks you for a password because mounting a filesystem requires superuser privileges. Do not circumvent it by allowing to run truecrypt as root without password, this is insecure as a malicious script can get elevated privileges by mounting a special-crafted container, and gain root privileges from it (e.g. setsuid binaries on in an ext2 filesystem or mounting on /).

Solution 2

Here is a quick fix you can use:

sudo visudo 

Add the line <yourusername> ALL=NOPASSWD: /usr/bin/truecrypt and save the file. truecrypt wont ask for your admin password anymore for . It quick and dirty, probably not safe, but works.

Comments

[Dexter]

Wouldn't it be easier just to put your user in the (fuse?) group, to allow mounting filesystems without superuser privilege? Mounting doesn't need root, but root has all privileges (including mount)... (At least that was the case in earlier Linux versions)

[i.amniels]

Thanks for the answer. When I have enough rep, I will upvote.

[Bruno Pereira]

If it works im happy enough. gl and if needed ask ;)

[Bruno Pereira]

Not anyone can mount if his username is declared on visudo, only him will be able to use it without sudo password.

[Lekensteyn]

@brunopereira81: that's true, but it's still a security risk. I've updated the answer.

[Bruno Pereira]

sounds great ;)

[tmt]

Note that the directive must be placed at the end of the config, otherwise it might be overridden by other directives, e.g. by %sudo ALL=(ALL:ALL) ALL and it won't work. It cost me a bit of time to figure this out.