SV-219185r987879: The Ubuntu operating system must require users to re-authenticate for privilege escalation and changing roles. | Canonical Ubuntu 18.04 LTS STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Ubuntu operating system must require users to re-authenticate for privilege escalation and changing roles.

Description

Discussion Text

Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When the Ubuntu operating system provides the capability to escalate a functional capability or change security roles, it is critical the user re-authenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002038SV-109701V-100597

References

DPMS Target Canonical Ubuntu 18.04 LTS DISA DPMS Target Canonical Ubuntu 18.04 LTS 4055

Checks

DISA STIG (Manual Reference)

Verify that "/etc/sudoers" has no occurrences of "NOPASSWD" or "!authenticate".

Check that the "/etc/sudoers" file has no occurrences of "NOPASSWD" or "!authenticate" by running the following command:

# sudo egrep -i '(nopasswd|!authenticate)' /etc/sudoers /etc/sudoers.d/*

If any occurrences of "NOPASSWD" or "!authenticate" return from the command, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.ubuntu1804:def:131
# The Ubuntu operating system must require users to re-authenticate for privilege escalation and changing roles.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# 'nopasswd' found in /etc/sudoers
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '(?i)nopasswd' '/etc/sudoers' &>/dev/null
}
# '!authenticate' found in /etc/sudoers
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -Pq '(?i)!authenticate' '/etc/sudoers' &>/dev/null
}
# 'nopasswd' found in /etc/sudoers.d
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  grep -rqP --include='*' '(?i)nopasswd' '/etc/sudoers.d' &>/dev/null
}
# '!authenticate' found in /etc/sudoers.d
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  grep -rqP --include='*' '(?i)!authenticate' '/etc/sudoers.d' &>/dev/null
}

if ( test_1 && test_2 && test_3 && test_4 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.ubuntu1804:def:131
if [ ! -f "/etc/sudoers" ]; then echo "PASS"; exit 0; fi
if grep -iq "nopasswd" /etc/sudoers || grep -iq "!authenticate" /etc/sudoers; then echo "FAIL"; exit 1; fi
for file in /etc/sudoers.d/*; do
    if [ -f "$file" ]; then
        if grep -iq "nopasswd" "$file" || grep -iq "!authenticate" "$file"; then echo "FAIL"; exit 1; fi
    fi
done
echo "PASS"; exit 0

Remediation

Remove any occurrence of "NOPASSWD" or "!authenticate" found in "/etc/sudoers" file or files in the /etc/sudoers.d directory.