Detections
Analytics

5.2.2 Ensure access on sudoers configuration files is configured

Information

The sudo configuration is defined in /etc/sudoers and in any files included from /etc/sudoers.d/. These files determine which users may escalate privileges and under what conditions.

If a sudoers file is writable by a user other than root, that user could grant unauthorized privilege escalation; if it is readable beyond root, the escalation policy is disclosed. Restricting each sudoers file to mode 0440 or more restrictive, owned by root and group root, ensures only root can read or modify the escalation policy. sudo refuses to run if these files are group- or world-writable.

Solution

Set the owner, group, and permissions on the sudoers files so that only root can read or modify them:

# chown root:root /etc/sudoers
# chmod u-wx,g-wx,o-rwx /etc/sudoers
# find /etc/sudoers.d/ -type f -exec chown root:root {} +
# find /etc/sudoers.d/ -type f -exec chmod u-wx,g-wx,o-rwx {} +

Modify sudoers content only with visudo.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 5fcd9fad7995c3bebe0fcb2886e42a9721f8e24afe1b7f3d42a3877bc39b420e