documentation_complete: true

title: 'Ensure invoking users password for privilege escalation when using sudo'


description: |-
    The sudoers security policy requires that users authenticate themselves before they can use sudo.
    When sudoers requires authentication, it validates the invoking user's credentials.
    The expected output for:
    <pre> sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)$' </pre>
    <pre> Defaults !targetpw
          Defaults !rootpw
          Defaults !runaspw </pre>
    or if cvtsudoers not supported:
    <pre> sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; </pre>
    <pre> /etc/sudoers:Defaults !targetpw
          /etc/sudoers:Defaults !rootpw
          /etc/sudoers:Defaults !runaspw </pre>

severity: medium

rationale: |-
    If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt
    the invoking user for the "root" user password.

identifiers:
    cce@rhel8: CCE-83422-6
    cce@rhel9: CCE-83529-8
    cce@rhel10: CCE-88855-2
    cce@sle12: CCE-83230-3
    cce@sle15: CCE-85747-4
    cce@slmicro5: CCE-93735-9
    cce@slmicro6: CCE-95043-6 

references:
    nist: CM-6(b),CM-6.1(iv)
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-010342
    stigid@ol8: OL08-00-010383
    stigid@sle12: SLES-12-010112
    stigid@sle15: SLES-15-020103

ocil_clause: 'invoke user passwd when using sudo'

ocil: |-
    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
    <pre> sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)' </pre>
    or if cvtsudoers not supported:
    <pre> sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; </pre>
    If no results are returned, this is a finding.
    If conflicting results are returned, this is a finding.
    If "Defaults !targetpw" is not defined, this is a finding.
    If "Defaults !rootpw" is not defined, this is a finding.
    If "Defaults !runaspw" is not defined, this is a finding.

fixtext: |-
    Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
    Defaults !targetpw
    Defaults !rootpw
    Defaults !runaspw

srg_requirement: |-
  {{{ full_name }}} must use the invoking user's password for privilege escalation when using "sudo".

platform: package[sudo]
