Linux distributions
TMA-ROCKY9-5.2.6
Ensure users must provide password for escalation
Beschreibung
sudo can be configured to require users to authenticate before running commands with elevated privileges. The NOPASSWD tag, where present in the sudoers configuration, lets a user run sudo commands without entering a password; without it, sudo prompts for the user's password before escalating privileges.
So wird geprüft
Prüfmethode: Shell-Befehl
alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -r "^[^#].*NOPASSWD" /etc/sudoers /etc/sudoers.d/' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file. Remove any line with occurrences of NOPASSWD tags in the file. Because sudo applies the last matching Defaults (and per-rule) definition, ensure no later-parsed file in /etc/sudoers.d re-introduces a NOPASSWD tag; see this section's overview for how the sudoers files combine.
Eigenschaften
- Betriebssysteme
- rocky-9
- Tags
- cis-convertedlinux
- Referenz
- CIS Rocky Linux 9 Benchmark v3.0.0 - 5.2.6
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target linux --level 2