Ensure sudo only includes the default configuration directory
An XCCDF Rule
Description
Administrators can configure authorized sudo users via drop-in files, and it is possible to include
other directories and configuration files from the file currently being parsed.
Make sure that /etc/sudoers only includes drop-in configuration files from /etc/sudoers.d,
or that no drop-in file is included.
Either the /etc/sudoers should contain only one #includedir directive pointing to
/etc/sudoers.d, and no file in /etc/sudoers.d/ should include other files or directories;
Or the /etc/sudoers should not contain any #include,
@include, #includedir or @includedir directives.
Note that the '#' character doesn't denote a comment in the configuration file.
Rationale
Some sudo configurtion options allow users to run programs without re-authenticating.
Use of these configuration options makes it easier for one compromised accound to be used to
compromise other accounts.
- ID
- xccdf_org.ssgproject.content_rule_sudoers_default_includedir
- Severity
- Medium
- References
- Updated
Remediation - Ansible
- name: Check for duplicate values
lineinfile:
path: /etc/sudoers
create: false
regexp: ^#includedir.*$
state: absent
Remediation - Shell Script
sudoers_config_file="/etc/sudoers"
sudoers_config_dir="/etc/sudoers.d"
sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
if [ "$sudoers_includedir_count" -gt 1 ]; then
sed -i "/#includedir/d" "$sudoers_config_file"