1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
documentation_complete: true
title: 'Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout'
description: |-
The sudo <tt>passwd_timeout</tt> tag sets the amount of time sudo password prompt waits.
{{%- if 'rhel' in product or 'ol' in families %}}
On {{{ full_name }}}, the default <tt>passwd_timeout</tt> value is 5 minutes.
{{% endif %}}
The passwd_timeout should be configured by making sure that the
<tt>passwd_timeout={{{ xccdf_value("var_sudo_passwd_timeout") }}}</tt> tag exists in
<tt>/etc/sudoers</tt> configuration file or any sudo configuration snippets
in <tt>/etc/sudoers.d/</tt>.
rationale: |-
Reducing the time <tt>sudo</tt> waits for a a password reduces the time the process is exposed.
severity: medium
identifiers:
cce@rhel8: CCE-83964-7
cce@sle12: CCE-91495-2
cce@sle15: CCE-91187-5
ocil_clause: 'passwd_timeout is not set with the appropriate value for sudo'
ocil: |-
To determine if <tt>passwd_timeout</tt> has been configured for sudo, run the following command:
<pre>$ sudo grep -ri '^Defaults.*passwd_timeout={{{ xccdf_value("var_sudo_passwd_timeout") }}}' /etc/sudoers /etc/sudoers.d/</pre>
The command should return a matching output.
template:
name: sudo_defaults_option
vars:
option: passwd_timeout
variable_name: "var_sudo_passwd_timeout"
|
