macOS
TMA-MACOS-5.11
Ensure Logging Is Enabled for Sudo
HighLevel 1Automatedmacos
Description
In order to properly monitor the use of the sudo command, logs events for any use of sudo should be captured in the unified log.
How it is checked
Audit method: Shell command
shell
out=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c "Log when a command is allowed by sudoers" || true- Expected output
1
How it is fixed
Fix method: Guidance or infrastructure patch
Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name>.
Properties
- Operating systems
- macos-26
- Tags
- macossystem-access
- Reference
- CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.11 Ensure Logging Is Enabled for Sudo
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target macos