Profile Applicability:
• Level 1
Description:
Requiring users to enter their password when using privilege escalation tools such as sudo ensures accountability and prevents unauthorized or accidental use of elevated privileges.
Rationale:
Enforcing password prompts for privilege escalation helps maintain security by verifying user identity before granting higher-level access.
Impact:
Pros:
Enhances security by requiring authentication for privilege escalation.
Supports auditability and accountability.
Cons:
May cause minor inconvenience for users needing frequent escalations.
Default Value:
By default, sudo prompts for a password unless configured otherwise.
Pre-requisites:
Root or sudo privileges to modify sudoers configuration.
Remediation:
Test Plan:
Using Linux command line:
Check sudoers configuration for NOPASSWD usage:
sudo grep -E 'NOPASSWD' /etc/sudoers /etc/sudoers.d/*
Verify that users or groups do not have the NOPASSWD tag allowing passwordless escalation.
Implementation Plan:
Using Linux command line:
Edit sudoers configuration safely using visudo:
visudo
Remove or comment out any NOPASSWD entries to ensure password is required for escalation. For example, change:
user ALL=(ALL) NOPASSWD: ALL user ALL=(ALL) ALL
Save and exit.
Backout Plan:
Using Linux command line:
Re-add NOPASSWD entries if necessary.
Test sudo functionality and user experience.
References: