Detections
Analytics
AIX7-00-002061 - AIX must remove NOPASSWD tag from sudo config files.
Information
sudo command does not require reauthentication if NOPASSWD tag is specified in /etc/sudoers config file, or sudoers files in /etc/sudoers.d/ directory. With this tag in sudoers file, users are not required to reauthenticate for privilege escalation.Solution
Edit "/etc/sudoers" using "visudo" command to remove all the "NOPASSWD" tags:# visudo -f
Editing a sudo config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tags, use "visudo" the command as follows:
# visudo -f /etc/sudoers.d/<config_file_name>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R2_STIG.zip
Item Details
Audit Name: DISA IBM AIX 7.x STIG v3r2
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-11, CAT|I, CCI|CCI-002038, CCI|CCI-004895, Rule-ID|SV-215260r1050789_rule, STIG-ID|AIX7-00-002061, STIG-Legacy|SV-101635, STIG-Legacy|V-91537, Vuln-ID|V-215260
Plugin: Unix
Control ID: aeb72760d99dda4ec18cbfdec938873390ea04c228b5a5a21509211d03bc4b65