Detections
Analytics

1.136 APPL-15-004022

Information

The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.

GROUP ID: V-274881
RULE ID: SV-274881r1099904

The file /etc/sudoers must include a timestamp_timout of 0.

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability or change user authenticators, it is critical the user reauthenticate.

Satisfies: SRG-OS-000373-GPOS-00156,SRG-OS-000373-GPOS-00157

Solution

Configure the macOS system to require reauthentication when using "sudo" with the following command:

/usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/timestamp_timeout/d' '{}' \;
/bin/echo "Defaults timestamp_timeout=0" >> /etc/sudoers.d/mscp

See Also

https://workbench.cisecurity.org/benchmarks/23761

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-11, CCI|CCI-002038, CCI|CCI-004895, Rule-ID|SV-274881r1099904_rule, STIG-ID|APPL-15-004022, Vuln-ID|V-274881

Plugin: Unix

Control ID: 091bd2c4f5569708879cf761aaeb027a9a5a6382d8c635813c31d5f6d66f5862