0037-sudoers-exist-Host /etc/sudoers Deleted¶

Rule ID¶

• 0037-sudoers-exist

Category¶

• storage

Severity¶

• critical

Compatible Versions¶

• Linux

Description¶

• Monitors whether the host /etc/sudoers file exists.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• In Linux, the /etc/sudoers file allows users to execute commands as the superuser or other users according to the security policy. The security policy determines what privileges a user must have to run sudo. The policy may require the user to authenticate themselves with a password or other authentication mechanism.

Risk Items¶

• Hacker infiltration

• Data leakage

Audit Method¶

• Verify whether the host /etc/sudoers file exists. You can run the following command:

ls /etc/sudoers

Remediation¶

Impact¶

• The system may not be able to log in normally.

Default Value¶

• None

References¶

• None

CIS Controls¶

• None