Ensure a Separate Timestamp Is Enabled for Each User/tty Combo

中级别 1自动化macos

说明

Using tty tickets ensures that a user must enter the sudo password in each Terminal session. With sudo versions 1.8 and higher, introduced in 10.12, the default value is to have tty tickets for each interface so that root access is limited to a specific terminal. The default configuration can be overwritten or not configured correctly on earlier versions of macOS.

检查方式

审计方法: Shell 命令

shell

out=$(/usr/bin/sudo -V 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c "Type of authentication timestamp record: tty" || true

预期输出: 1

修复方式

修复方法: 操作指南或基础设施补丁

Terminal: sudo /usr/sbin/visudo -f /etc/sudoers.d/<configuration file name>.

属性

操作系统: macos-15
标签: macossystem-access
参考: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.5 Ensure a Separate Timestamp Is Enabled for Each User/tty Combo

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target macos