Enabling Claude Code to Use sudo on Ubuntu (fixing 'a terminal is required')

Running root commands like apt install or systemctl from the Claude Code CLI throws sudo: a terminal is required to read the password. Here's how to fix it safely, without NOPASSWD.

TL;DR

# /etc/sudoers (sudo visudo) — Defaults 섹션에 추가
Defaults timestamp_timeout=60   # 비밀번호 입력 후 60분 캐시
Defaults !tty_tickets           # 모든 tty에서 credential 공유 (이게 핵심)
 
# 실행: 먼저 credential 캐시 후 Claude Code 기동
sudo -v && claude --dangerously-skip-permissions

In Claude Code, sudo whoami → root means success. After 60 minutes, refresh with sudo -v.

Why this approach

Claude Code's bash session isn't an interactive terminal, so it can't enter a password — that's what blocks sudo.

The easiest workaround is yohan ALL=(ALL) NOPASSWD: ALL, but don't use it. If the account is compromised, an attacker gets root instantly (plenty of servers have been breached over exactly this). Instead, keep password authentication and gain convenience only through credential caching.

The key is !tty_tickets. By default credentials are separated per tty, so even if you run sudo -v in a terminal, it won't apply to Claude Code's bash session. Turning on cross-tty sharing with !tty_tickets lets Claude Code inherit the credential you cached in the terminal.

Security comparison

Being breached within the cached 60 minutes is indeed dangerous. But it's the difference between "leaving the door always open" and "opening it briefly and closing it." To be more conservative, drop it to timestamp_timeout=15.

Lessons

• The cause of sudo: a terminal is required isn't the sudo config but the non-interactive shell — solve it by caching the credential beforehand.
• !tty_tickets is the real switch. Without it, even sudo -v won't apply to the Claude Code session.
• Convenience (NOPASSWD) and security aren't either/or. Caching + expiry gets you both.