Detections
Analytics

5.2.6 Ensure users must provide password for escalation

Information

sudo can be configured to require users to authenticate before running commands with elevated privileges. The NOPASSWD tag, where present in the sudoers configuration, lets a user run sudo commands without entering a password; without it, sudo prompts for the user's password before escalating privileges.

The NOPASSWD tag allows a user to run commands via sudo without re-entering a password. Requiring a password for privilege escalation verifies the invoking user's identity before elevated commands run, and limits an attacker with access to an unlocked session or a compromised account from escalating privileges without knowing the account password.

Solution

Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file.

Remove any line with occurrences of NOPASSWD tags in the file.

Because sudo applies the last matching Defaults (and per-rule) definition, ensure no later-parsed file in /etc/sudoers.d re-introduces a NOPASSWD tag; see this section's overview for how the sudoers files combine.

Impact:

Applying this removes passwordless sudo, so service or automation accounts that rely on non-interactive (passwordless) privilege escalation (for example, database failover or orchestration tooling) will no longer be able to escalate without providing a password.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: 6ab702b4ca0af1492ade80e1eaf1445a44a0f58aa8d07866e25e4d3e397acb60