Detections
Analytics

5.2.10 Ensure sudo timestamp_timeout is configured

Information

sudo timestamp_timeout controls how long a user's sudo privileges remain active after the initial password entry.

A timeout value reduces the window of opportunity for unauthorized privileged sudo access.

Solution

Edit the file listed in the audit section with visudo -f <PATH TO FILE> and modify the entry timestamp_timeout= to 15 minutes or less as per your site policy. The value is in minutes. This particular entry may appear on its own, or on the same line as env_reset . See the following two examples:

Example 1:

Defaults env_reset, timestamp_timeout=15

Example 2:

Defaults timestamp_timeout=15
Defaults env_reset

Because sudo applies the last matching Defaults definition, place this setting so that no later-parsed file in /etc/sudoers.d overrides it with a larger value; see this section's overview for how the sudoers files combine.

Impact:

A shorter authentication timeout causes users to re-enter their password more often within a session.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|IA-11, CSCv7|4.3

Plugin: Unix

Control ID: 8edfbb5500ecdd4603dbad1632c39109c33d6a2ea28f9eca0b9a1fb7e00ff447