0068-sudo-use-pty - sudo command does not use pty¶

Rule ID¶

• 0068-sudo-use-pty

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Attackers can use sudo to run malicious programs (e.g., viruses or malware) that fork background processes remaining on the user's terminal device, even after the main program has completed execution.

To avoid this, you can configure sudo to only run other commands from a pseudo-pty using the use_pty parameter, regardless of whether I/O logging is enabled.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Attackers can use sudo to run malicious programs that spawn a background process that persists even after the main program finishes execution.

This can be mitigated by configuring sudo to only run other commands from a pseudo-pty.

Risk Items¶

• Attackers exploit sudo to run malicious programs

Audit Method¶

• Verify that sudo can only run other commands from a pseudo-pty by running the following command:

grep -Ei "^\s*Defaults\s+([^#]\S+,\s*)?use_pty\b" /etc/sudoers /etc/sudoers.d/*

Defaults use_pty

Remediation¶

• Edit the /etc/sudoers file using visudo or visudo -f <PATH TO FILE> and add the following line: Defaults use_pty

Defaults use_pty

Impact¶

• After configuring sudo to use a pty, the risk of attackers exploiting sudo to run malicious programs is effectively mitigated.

Default Value¶

• Not configured by default

References¶

• 5 Tips for Setting 'sudo' in Linux (Unofficial)

CIS Controls¶

• Version 7

  4 Controlled Use of Administrative Privileges

  Controlled Use of Administrative Privileges