Detections
Analytics

5.2.9 Ensure sudo visiblepw is configured

Information

The visiblepw sudo option controls whether sudo will prompt for a password on a terminal that cannot disable local echo. When not enabled (the default), sudo refuses to run rather than prompt for a password that would be displayed as it is typed.

If visiblepw is enabled, sudo prompts for a password even when the terminal cannot suppress echo (for example, a command run over SSH without a pseudo-terminal). The password is then entered in cleartext where it can be observed, captured in a screen or session recording, or written to logs. Leaving visiblepw disabled ensures a password is only requested when it can be entered without being displayed.

Solution

Ensure sudo will not prompt for a password on a terminal where it would be displayed. Edit the appropriate sudoers file with visudo and remove any line that enables visiblepw, or explicitly disable it:

# visudo

Add or correct the line:

Defaults !visiblepw

Impact:

Automated or non-interactive workflows that invoke sudo without a pseudo-terminal will fail with a password-prompt error rather than exposing the password. Allocate a pseudo-terminal (for example, ssh -t ) for such workflows, or use an appropriate documented exception.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|IA-6, CSCv7|4.3

Plugin: Unix

Control ID: e3a9d093aa19f40ee66c327da7a6b9c9f22e34d4f2642ad6f4d62398c595f746