Detections
Analytics

1.287 OL09-00-002363

Information

OL 9 must require users to provide a password for privilege escalation.

GROUP ID: V-271725
RULE ID: SV-271725r1155318

Without reauthentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate.

Solution

Configure OL 9 to not allow users to execute privileged actions without authenticating with a password.

Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory.

$ sudo sed -i '/NOPASSWD/ s/^/# /g' /etc/sudoers /etc/sudoers.d/*

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9), CCI|CCI-002234, Rule-ID|SV-271725r1155318_rule, STIG-ID|OL09-00-002363, Vuln-ID|V-271725

Plugin: Unix

Control ID: 26e39c0fad613a36626ae0b5b98865024fd5910068346fc0d9c6fc152ee9e547