0036-sudoers-sudoers Modified¶

Rule ID¶

• 0036-sudoers

Category¶

• system

Level¶

• warn

Supported Versions¶

• Linux

Description¶

• Monitors whether the host /etc/sudoers file has been modified

Scan Frequency¶

• disable

Rationale¶

• In Linux, the /etc/sudoers file allows users to execute commands as the superuser or other users, as specified by the security policy. The security policy determines which privileges a user must have to run sudo. This policy may require users to authenticate themselves using a password or other authentication mechanisms.

Risk Items¶

• Hacker intrusion

• Data leakage

Audit Method¶

• Verify whether the host /etc/sudoers file exists. You can run the following command to verify:

cat /etc/sudoers

Remediation¶

• None

Impact¶

• The system may not be able to log in normally

Default Value¶

• None

References¶

• None

CIS Controls¶

• None