Detections
Analytics

5.2.5 Ensure re-authentication for privilege escalation is not disabled globally

Information

The operating system must be configured so that users must re-authenticate for privilege escalation.

Note: On sudo-rs (the default on Debian 13 and Ubuntu 26.04+), verifypw is hard-coded to all and the !authenticate tag does not bypass authentication. This recommendation is automatically enforced on sudo-rs even if a !authenticate tag is present in sudoers files. Explicit removal of !authenticate remains the policy goal for portability and clarity (the same configuration will fail on a classic-sudo system).

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.

Solution

Configure the operating system to require users to reauthenticate for privilege escalation.

Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file.

Remove any occurrences of !authenticate tags in the file(s).

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: 042e2739f092386081c4bb6d323ba92295fa4b97b4677699c866b18d219952d1