Detections
Analytics

1.288 OL09-00-002364

Information

OL 9 must not be configured to bypass password requirements for privilege escalation.

GROUP ID: V-271726
RULE ID: SV-271726r1091890

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.

Solution

Configure the operating system to require users to supply a password for privilege escalation.

Remove any occurrences of " pam_succeed_if " in the "/etc/pam.d/sudo" file.

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9), CCI|CCI-002234, Rule-ID|SV-271726r1091890_rule, STIG-ID|OL09-00-002364, Vuln-ID|V-271726

Plugin: Unix

Control ID: 794089c37e31bbea676b50f912e2fcc807cea57e561152e137ff10e379bce7e0