Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout

An XCCDF Rule

Description

The sudo passwd_timeout tag sets the amount of time sudo password prompt waits. On Red Hat Enterprise Linux 7, the default passwd_timeout value is 5 minutes. The passwd_timeout should be configured by making sure that the passwd_timeout= tag exists in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale

Reducing the time sudo waits for a a password reduces the time the process is exposed.

ID: xccdf_org.ssgproject.content_rule_sudo_add_passwd_timeout
Severity: Medium
Updated: about 1 year ago

- name: XCCDF Value var_sudo_passwd_timeout # promote to variable
  set_fact:
    var_sudo_passwd_timeout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout" use="legacy"/>
  tags:
    - always
- name: Ensure passwd_timeout is enabled with the appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\bpasswd_timeout=[-]?.+\b(.*)$
    line: Defaults \1passwd_timeout={{ var_sudo_passwd_timeout }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_passwd_timeout_option
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_passwd_timeout

- name: Enable passwd_timeout option with appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    line: Defaults passwd_timeout={{ var_sudo_passwd_timeout }}
    validate: /usr/sbin/visudo -cf %s
  when: edit_sudoers_passwd_timeout_option is defined and not edit_sudoers_passwd_timeout_option.changed
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_passwd_timeout



var_sudo_passwd_timeout='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout" use="legacy"/>'


if /usr/sbin/visudo -qcf /etc/sudoers; then    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\bpasswd_timeout=\w+\b\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option passwd_timeout
        echo "Defaults passwd_timeout=${var_sudo_passwd_timeout}" >> /etc/sudoers
    else
        # sudoers file defines Option passwd_timeout, remediate if appropriate value is not set
        if ! grep -P "^[\s]*Defaults.*\bpasswd_timeout=${var_sudo_passwd_timeout}\b.*$" /etc/sudoers; then
            
            escaped_variable=${var_sudo_passwd_timeout//$'/'/$'\/'}
            sed -Ei "s/(^[\s]*Defaults.*\bpasswd_timeout=)[-]?.+(\b.*$)/\1$escaped_variable\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout

Description

Rationale

Remediation - Ansible

Remediation - Shell Script