AIX must remove NOPASSWD tag from sudo config files.
An XCCDF Rule
Description
sudo command does not require reauthentication if NOPASSWD tag is specified in /etc/sudoers config file, or sudoers files in /etc/sudoers.d/ directory. With this tag in sudoers file, users are not required to reauthenticate for privilege escalation.
- ID
- SV-215260r1009545_rule
- Version
- AIX7-00-002061
- Severity
- High
- References
- Updated
Remediation Templates
A Manual Procedure
Edit "/etc/sudoers" using "visudo" command to remove all the "NOPASSWD" tags:
# visudo -f
Editing a sudo config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tags, use "visudo" the command as follows:
# visudo -f /etc/sudoers.d/<config_file_name>