Detections
Analytics

5.2.7 Ensure re-authentication for privilege escalation is not disabled globally

Information

The operating system must be configured so that users must re-authenticate for privilege escalation.

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.

Solution

Configure the operating system to require users to reauthenticate for privilege escalation.

Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file.

Remove any occurrences of !authenticate tags in the file(s).

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CAT|II, CSCv7|4.3, Rule-ID|SV-230272r854027_rule, STIG-ID|RHEL-08-010381, Vuln-ID|V-230272

Plugin: Unix

Control ID: 0b240bc236c8419120c2ebc2ca82d966eafe34c163d8de1d97682659ef4cd6b8