Check: TOSS-04-020190
Tri-Lab Operating System Stack (TOSS) 4 STIG:
TOSS-04-020190
(in versions v1 r3 through v1 r1)
Title
TOSS must require users to provide a password for privilege escalation. (Cat II impact)
Discussion
Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.
Check Content
Verify that "/etc/sudoers" has no occurrences of "NOPASSWD." Check that the "/etc/sudoers" file has no occurrences of "NOPASSWD" by running the following command: $ sudo grep -i nopasswd /etc/sudoers /etc/sudoers.d/* %admin ALL=(ALL) NOPASSWD: ALL If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the ISSO as an organizationally defined administrative group utilizing MFA, this is a finding.
Fix Text
Remove any occurrence of "NOPASSWD" found in "/etc/sudoers" file or files in the "/etc/sudoers.d" directory.
Additional Identifiers
Rule ID: SV-252959r824201_rule
Vulnerability ID: V-252959
Group Title: SRG-OS-000373-GPOS-00157
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002038 |
The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication. |
Controls
Number | Title |
---|---|
IA-11 |
Re-Authentication |