The sudoers file must be configured to authenticate users on a per-tty basis.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-67709	AOSX-11-000995	SV-82199r1_rule		High

Description
The sudo command must be configured to prompt for the administrator user's password at least once in each newly opened Terminal window or remote login session, as this prevents a malicious user from taking advantage of an unlocked computer or an abandoned login session to bypass the normal password prompt requirement. Without the tty_tickets option, all open local and remote logon sessions would be authenticated to use sudo without a password for the duration of the configured password timeout window.

Description

The sudo command must be configured to prompt for the administrator user's password at least once in each newly opened Terminal window or remote login session, as this prevents a malicious user from taking advantage of an unlocked computer or an abandoned login session to bypass the normal password prompt requirement. Without the tty_tickets option, all open local and remote logon sessions would be authenticated to use sudo without a password for the duration of the configured password timeout window.

STIG	Date
Apple OS X 10.11 Security Technical Implementation Guide	2017-04-06

Details

Check Text ( C-68275r1_chk )
To check if the "tty_tickets" option is set for "/usr/bin/sudo", run the following command: /usr/bin/sudo /usr/bin/grep tty_tickets /etc/sudoers If there is no result, this is a finding.

Fix Text (F-73823r1_fix)
Edit the "/etc/sudoers" file to contain the line: Defaults tty_tickets This line can be placed in the defaults section or at the end of the file.