← Back to Apple macOS 13 (Ventura) Security Technical Implementation Guide

V-257239

CAT II (Medium)

The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.

Rule ID

SV-257239r1050789_rule

STIG

Apple macOS 13 (Ventura) Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-002038

Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Check Content

Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command:

/usr/bin/sudo /usr/bin/grep -r "timestamp_timeout" /etc/sudoers*

/etc/sudoers.d/<customfile>:Defaults    timestamp_timeout=0 

If conflicting results are returned, this is a finding.

If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.

Fix Text

Configure the macOS system to require reauthentication when using the "sudo" command by creating a plain text file in the /private/etc/sudoers.d/ directory containing the following:

Defaults timestamp_timeout=0