0038-sudoers-priv-Are Permissions of the sudoers File Changed¶

Rule ID¶

• 0038-sudoers-priv

Category¶

• system

Level¶

• critical

Supported Versions¶

• Linux

Description¶

• Monitor whether the permissions of the host file /etc/sudoers have been modified.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The host file /etc/sudoers allows specific users to execute various commands as the root user without requiring the root password.

Risk Items¶

• Feature unavailable

Audit Method¶

• Run the following command and verify that Uid and Gid are both 0/root, and Access does not grant group or other permissions:

stat /etc/sudoers
Access: (0440/-r--r-----) Uid: ( 0/root) Gid: ( 0/root)

Remediation¶

• If the permissions of the /etc/sudoers file are detected to have been changed, log in to the server as the root user, restore the permissions, and audit the change.

Impact¶

• Feature unavailable

Default Value¶

• None

References¶

• Emergency Investigation Ideas and Process for Hacker Intrusion (Unofficial)
• A Real Mining Intrusion Investigation Analysis (Unofficial)

CIS Controls¶

• None