Sudo Defaults¶

The Defaults lines in /etc/sudoers control how sudo behaves for everyone. Four of them matter for a hardened image.

Option	Set to	Why
`use_pty`	present (CIS 5.1.2)	Sudo runs the command in its own pseudo-terminal, so a malicious command can't inject keystrokes back into the administrator's real terminal after it exits
`logfile="/var/log/sudo.log"`	present (CIS 5.1.3)	Every sudo command is written to a file you can read, in addition to the auth log. Makes the Reading the Logs page useful.
`timestamp_timeout`	5 to 15 minutes, or absent (default 15; CIS 5.1.6)	How long sudo remembers the password. `-1` means forever for that session, which means a walked-away terminal is a root terminal.
`!authenticate`	absent (CIS 5.1.5)	Turns off the password prompt for everyone

Others already present (env_reset, secure_path, mail_badpass) stay.

Apply¶

sudo visudo

Add or fix, near the other Defaults lines:

Defaults        use_pty
Defaults        logfile="/var/log/sudo.log"
Defaults        timestamp_timeout=15

And remove any Defaults !authenticate or Defaults timestamp_timeout=-1. Files in /etc/sudoers.d/ can carry Defaults lines too, so check them the same way.

Verify¶

sudo grep -rhE '^Defaults' /etc/sudoers /etc/sudoers.d/
sudo -k; sudo true; sudo tail -n 1 /var/log/sudo.log

The second line forces a fresh password prompt, runs a harmless command, and shows it in the log.

Example¶

grep Defaults /etc/sudoers shows Defaults timestamp_timeout=-1 and Defaults !authenticate. With those two, anyone in the sudo group is root without ever typing a password. Remove both, add use_pty and the logfile.

Try it¶

Set timestamp_timeout=1, run sudo true, wait two minutes, run it again.
Set the logfile and read your own commands in it.

Build it¶

Add the Defaults checks to sudocheck.sh.

Next¶

The Root Account