Ensure the Sudo Timeout Period Is Set to Zero

TinggiLevel 1Otomatismacos

Deskripsi

The sudo command allows the user to run programs as the root user. Working as the root user allows the user an extremely high level of configurability within the system. This control, along with the control to use a separate timestamp for each tty, limits the window where an unauthorized user, process, or attacker could utilize legitimate credentials that are valid for longer than required. Audit: Requires a 0.0 minute sudo timestamp timeout and /etc/sudoers.d owned by root:wheel. Run as root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

v=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
c=$(printf '%s\n' "$v" | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes")
o=$(/usr/bin/stat -f '%Su:%Sg' /etc/sudoers.d 2>/dev/null)
if [ "$c" -ge 1 ] && [ "$o" = root:wheel ]; then echo compliant; else echo "timeout-zero=$c owner=$o"; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name> ; sudo /usr/sbin/chown -R root:wheel /etc/sudoers.d/.

Properti

Sistem operasi: macos-15
Tag: macossystem-access
Referensi: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.4 Ensure the Sudo Timeout Period Is Set to Zero

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target macos