Ensure users must provide password for escalation

낮음레벨 2자동linux

설명

sudo can be configured to require users to authenticate before running commands with elevated privileges. The NOPASSWD tag, where present in the sudoers configuration, lets a user run sudo commands without entering a password; without it, sudo prompts for the user's password before escalating privileges.

점검 방법

감사 방식: 셸 명령

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -r "^[^#].*NOPASSWD" /etc/sudoers /etc/sudoers.d/' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file. Remove any line with occurrences of NOPASSWD tags in the file. Because sudo applies the last matching Defaults (and per-rule) definition, ensure no later-parsed file in /etc/sudoers.d re-introduces a NOPASSWD tag; see this section's overview for how the sudoers files combine.

속성

운영 체제: rocky-9
태그: cis-convertedlinux
참고 자료: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.2.6

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux --level 2