Detections
Analytics

5.2.8 Ensure sudo pwfeedback is configured

Information

The pwfeedback option provides visual feedback (for example, an asterisk) for each character as the sudo password is typed. When not enabled (the default), no feedback is displayed.

Visual feedback discloses the exact length of the password to anyone able to observe the terminal or a session recording, weakening it against shoulder-surfing and offline analysis. The option has also been associated with input-handling defects in older versions of sudo. Leaving pwfeedback disabled removes the length side-channel and keeps sudo on its hardened default.

Solution

Ensure sudo does not display feedback while the password is typed. Edit the appropriate sudoers file with visudo and remove any line that enables pwfeedback, or explicitly disable it:

# visudo

Add or correct the line:

Defaults !pwfeedback

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|IA-6, CSCv7|4.3

Plugin: Unix

Control ID: c27a5f5e175f0f58c53f26a52c86249c27ec4d012b765bd55fe5cb02505ba816