cis-ubuntu1604-v200-5-2-2

name	cis-ubuntu1604-v200-5-2-2
description	Ensure sudo commands use pty
category	cis-iam
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","access-control"]
cis_id	5.2.2
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - 5.2.2

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

sudo can be configured to run only from a pseudo-pty.

Note: visudo edits the sudoers file in a safe fashion, analogous to vipw(8). visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks or parse errors. If the sudoers file is currently being edited you will receive a message to try again later.

Rationale

Attackers can run a malicious program using sudo, which would again fork a background process that remains even when the main program has finished executing.

Impact

None.

Audit Procedure

Command Line

Verify that sudo can only run other commands from a pseudo-pty. Run the following command:

grep -Ei '^\s*Defaults\s+([^#]+,\s*)?use_pty(,\s+\S+\s*)*(\s+#.*)?$' /etc/sudoers /etc/sudoers.d/*

Expected Result

The output should include a line matching:

Defaults use_pty

Remediation

Command Line

Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo -f and add the following line:

Defaults use_pty

Default Value

By default, sudo does not require a pseudo-pty.

References

1. SUDO(8)

CIS Controls

Controls Version	Control
v7	4.3 Ensure the Use of Dedicated Administrative Accounts

Assessment Status

Automated