Detections
Analytics

5.2.7 Ensure re-authentication for privilege escalation is not disabled globally

Information

By default sudo re-authenticates the invoking user before escalating privileges. The !authenticate tag, where present in the sudoers configuration, disables that re-authentication; without it, sudo prompts the user to confirm their identity before running elevated commands.

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.

Solution

Configure the operating system to require users to reauthenticate for privilege escalation.

Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file.

Remove any occurrences of !authenticate tags in the file(s).

Because sudo applies the last matching definition, ensure no later-parsed file in /etc/sudoers.d re-introduces an !authenticate tag; see this section's overview for how the sudoers files combine.

Impact:

Where !authenticate was in use, affected users will be prompted for their password when escalating privileges rather than escalating without one. This likewise affects any non-interactive or automation context that relied on !authenticate to escalate without a prompt.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: eab01dc6b7e9c21943d62ca662d11f03768184941e7de93ef2b857527aa3ca2b