AOSX-13-000995 - The macOS system must be configured with the sudoers file configured to authenticate users on a per -tty basis.

Information

The 'sudo' command must be configured to prompt for the administrator's password at least once in each newly opened Terminal window or remote logon session, as this prevents a malicious user from taking advantage of an unlocked computer or an abandoned logon session to bypass the normal password prompt requirement.

Without the 'tty_tickets' option, all open local and remote logon sessions would be authenticated to use sudo without a password for the duration of the configured password timeout window.

Solution

Edit the '/etc/sudoers' file to contain the line:

Defaults tty_tickets

This line can be placed in the defaults section or at the end of the file.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_OS_X_10-13_V2R5_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|I, CCI|CCI-000366, Rule-ID|SV-214900r609363_rule, STIG-ID|AOSX-13-000995, STIG-Legacy|SV-96393, STIG-Legacy|V-81679, Vuln-ID|V-214900

Plugin: Unix

Control ID: 5505d74798c483fc6a06602d14b73620c0bfe73af6328ec1bf59d3b58b5dbb26