The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.

STIG ID: APPL-13-004022  |  SRG: SRG-OS-000373-GPOS-00156 |  Severity: medium |  CCI: CCI-002038 |  Vulnerability Id: V-257239

Vulnerability Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.

Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Check

Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command:

/usr/bin/sudo /usr/bin/grep -r "timestamp_timeout" /etc/sudoers*

/etc/sudoers.d/<customfile>:Defaults timestamp_timeout=0

If conflicting results are returned, this is a finding.

If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.

Fix

Configure the macOS system to require reauthentication when using the "sudo" command by creating a plain text file in the /private/etc/sudoers.d/ directory containing the following:

Defaults timestamp_timeout=0
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.