The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.
An XCCDF Rule
Description
The file /etc/sudoers must include a timestamp_timout of 0. Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability or change user authenticators, it is critical the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156,SRG-OS-000373-GPOS-00157,SRG-OS-000373-GPOS-00158
- ID
- SV-259555r1050789_rule
- Version
- APPL-14-004022
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the macOS system to require reauthentication when using "sudo" with the following command:
/usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/timestamp_timeout/d' '{}' \;
/bin/echo "Defaults timestamp_timeout=0" >> /etc/sudoers.d/mscp