documentation_complete: true

title: Disallow Configuration to Bypass Password Requirements for Privilege Escalation

description: |-
    Verify the operating system is not configured to bypass password requirements for privilege
    escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
    <pre>$ sudo grep pam_succeed_if /etc/pam.d/sudo</pre>
    If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.


rationale: |-
    Without re-authentication, users may access resources or perform tasks for which they do not
    have authorization. When operating systems provide the capability to escalate a functional
    capability, it is critical the user re-authenticate.

severity: medium

identifiers:
    cce@rhel8: CCE-86319-1
    cce@rhel9: CCE-85967-8
    cce@rhel10: CCE-89298-4
    cce@sle12: CCE-83250-1
    cce@sle15: CCE-91156-0

references:
    nist: IA-11
    srg: SRG-OS-000373-GPOS-00156,SRG-OS-000373-GPOS-00157,SRG-OS-000373-GPOS-00158
    stigid@ol7: OL07-00-010344
    stigid@ol8: OL08-00-010385
    stigid@sle12: SLES-12-010114
    stigid@sle15: SLES-15-020104

ocil_clause: |-
    system is configured to bypass password requirements for privilege escalation

ocil: |-
    Verify the operating system is not configured to bypass password requirements for privilege
    escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
    <pre>$ sudo grep pam_succeed_if /etc/pam.d/sudo</pre>

fixtext: |-
    Configure the operating system to require users to supply a password for privilege escalation.

    Check the configuration of the "/etc/pam.d/sudo" file with the following command:
    $ sudo vi /etc/pam.d/sudo

    Remove any occurrences of " pam_succeed_if " in the file.

srg_requirement: '{{{ full_name }}} must not be configured to bypass password requirements for privilege escalation.'

platform: package[pam] and system_with_kernel
