Detections
Analytics

6.1.3 Ensure sudo commands use pty

Information

sudo can be configured to run only from a pseudo terminal ( pseudo-pty )

Attackers can run a malicious program using sudo, which would again fork a background process that remains even when the main program has finished executing.

Solution

Edit the file /etc/sudoers with visudo or a file in /etc/sudoers.d/ with /usr/sbin/visudo -f <PATH TO FILE> and add the following line:

Defaults use_pty

Edit the file /etc/sudoers with visudo and any files in /etc/sudoers.d/ with /usr/sbin/visudo -f <PATH TO FILE> and and remove any occurrence of !use_pty

Impact:

WARNING : Editing the sudo configuration incorrectly can cause sudo to stop functioning. Always use visudo to modify sudo configuration files.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: ea954dede5c4130d37211d932c8b140e8c26228c3a69dfdc666575a54f8cbacd