Ensure a Separate Timestamp Is Enabled for Each User/tty Combo

MediumLevel 1Automatedmacos

Description

Using tty tickets ensures that a user must enter the sudo password in each Terminal session. With sudo versions 1.8 and higher, introduced in 10.12, the default value is to have tty tickets for each interface so that root access is limited to a specific terminal. The default configuration can be overwritten or not configured correctly on earlier versions of macOS.

How it is checked

Audit method: Shell command

shell

out=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c "Type of authentication timestamp record: tty" || true

Expected output: 1

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name>.

Properties

Operating systems: macos-26
Tags: macossystem-access
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.5 Ensure a Separate Timestamp Is Enabled for Each User/tty Combo

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos