Linux distributions
TMA-ROCKY9-5.2.6
Ensure users must provide password for escalation
Deskripsi
sudo can be configured to require users to authenticate before running commands with elevated privileges. The NOPASSWD tag, where present in the sudoers configuration, lets a user run sudo commands without entering a password; without it, sudo prompts for the user's password before escalating privileges.
Cara pemeriksaan
Metode audit: Perintah shell
alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -r "^[^#].*NOPASSWD" /etc/sudoers /etc/sudoers.d/' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file. Remove any line with occurrences of NOPASSWD tags in the file. Because sudo applies the last matching Defaults (and per-rule) definition, ensure no later-parsed file in /etc/sudoers.d re-introduces a NOPASSWD tag; see this section's overview for how the sudoers files combine.
Properti
- Sistem operasi
- rocky-9
- Tag
- cis-convertedlinux
- Referensi
- CIS Rocky Linux 9 Benchmark v3.0.0 - 5.2.6
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target linux --level 2