Detections
Analytics
5.2.11 Ensure sudo timestamp_type is configured
Information
After a successful authentication, sudo caches the credential for a short period. The timestamp_type option controls the scope of that cached credential: tty (per terminal, the default), ppid (per parent process), kernel, or global (one record shared by all of the user's processes and sessions).With timestamp_type=global, one successful sudo authentication is honored by every concurrent process and session belonging to that user, widening the window in which an unattended or hijacked session can escalate privileges without re-authenticating. Scoping the timestamp to the terminal (the default, tty ) limits credential reuse to the session in which the user actually authenticated.
Solution
Ensure the sudo authentication timestamp is scoped to the terminal rather than shared globally. Edit the appropriate sudoers file with visudo and remove any Defaults timestamp_type=global, or set a non-global value:# visudo
Defaults timestamp_type=tty
Impact:
Users who operate multiple terminals may be prompted to authenticate in each terminal rather than once for all sessions.
See Also
Item Details
Audit Name: CIS Rocky Linux 9 v3.0.0 L1 Server
Category: ACCESS CONTROL
References: 800-53|AC-6, 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3
Plugin: Unix
Control ID: 60b2e987520b4a3de364bff5c0bde9da7843035279f97c3b7658928df01f031e