Ensure the Sudo Timeout Period Is Set to Zero

HighLevel 1Automatedmacos

Description

The sudo command allows the user to run programs as the root user. Working as the root user allows the user an extremely high level of configurability within the system. This control, along with the control to use a separate timestamp for each tty, limits the window where an unauthorized user, process, or attacker could utilize legitimate credentials that are valid for longer than required. Audit: Requires a 0.0 minute sudo timestamp timeout and /etc/sudoers.d owned by root:wheel. Run as root.

How it is checked

Audit method: Shell command

shell

v=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
c=$(printf '%s\n' "$v" | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes")
o=$(/usr/bin/stat -f '%Su:%Sg' /etc/sudoers.d 2>/dev/null)
if [ "$c" -ge 1 ] && [ "$o" = root:wheel ]; then echo compliant; else echo "timeout-zero=$c owner=$o"; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name> ; sudo /usr/sbin/chown -R root:wheel /etc/sudoers.d/.

Properties

Operating systems: macos-26
Tags: macossystem-access
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.4 Ensure the Sudo Timeout Period Is Set to Zero

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos