SV-215260r508663_rule
V-215260
SRG-OS-000373-GPOS-00156
AIX7-00-002061
CAT I
10
Edit "/etc/sudoers" using "visudo" command to remove all the "NOPASSWD" tags:
# visudo -f
Editing a sudo config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tags, use "visudo" the command as follows:
# visudo -f /etc/sudoers.d/<config_file_name>
If sudo is not used on AIX, this is Not Applicable.
Run the following command to find the "NOPASSWD" tag in "/etc/sudoers" file:
# grep NOPASSWD /etc/sudoers
If there is a "NOPASSWD" tag found in "/etc/sudoers" file, this is a finding.
Run the following command to find the "NOPASSWD" tag in one of the sudo config files in "/etc/sudoers.d/" directory:
# find /etc/sudoers.d -type f -exec grep -l NOPASSWD {} \;
The above command displays all sudo config files that are in "/etc/sudoers.d/" directory and they contain the "NOPASSWD" tag.
If above command found a config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tag, this is a finding.
V-215260
False
AIX7-00-002061
If sudo is not used on AIX, this is Not Applicable.
Run the following command to find the "NOPASSWD" tag in "/etc/sudoers" file:
# grep NOPASSWD /etc/sudoers
If there is a "NOPASSWD" tag found in "/etc/sudoers" file, this is a finding.
Run the following command to find the "NOPASSWD" tag in one of the sudo config files in "/etc/sudoers.d/" directory:
# find /etc/sudoers.d -type f -exec grep -l NOPASSWD {} \;
The above command displays all sudo config files that are in "/etc/sudoers.d/" directory and they contain the "NOPASSWD" tag.
If above command found a config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tag, this is a finding.
M
4012