Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Amazon Linux 2023 CIS 4.3.4 (re-authentication not disabled globally) is mapped to sudo_require_reauthentication instead of sudo_remove_no_authenticate

Chiusa Adatta ai principianti
  • Qualcosa non va?
#15,152 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Una pull request collegata è già stata integrata.

  • #15167 di @cristianchiriac — integrata

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
88/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
linux
Ambito
operating-systems, security

Direzione di ricerca

Iniziare da controls/cis_al2023.yml intorno a controls 4.3.4 e 4.3.5, quindi confrontare le regole sudo referenziate e le mappature analoghe dei controlli CIS elencate nell’issue. Aggiornare 4.3.4 in modo che utilizzi sudo_remove_no_authenticate, mantenendo 4.3.5 su sudo_require_reauthentication. Compilare il data stream al2023, convalidarlo con oscap ds sds-validate e riprodurre le valutazioni sudoers elencate.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Amazon Linux triaged
Description of problem:

Found while comparing CIS results on Amazon Linux 2023 images.

  • Product: al2023
  • Profiles: cis_server_l1, cis; control 4.3.4 "Ensure re-authentication for privilege escalation is not disabled globally"
  • Selected rule: sudo_require_reauthentication; expected: sudo_remove_no_authenticate

controls/cis_al2023.yml selects sudo_require_reauthentication for both 4.3.4 and 4.3.5 "Ensure sudo authentication timeout is configured correctly" (L1280-L1294 at v0.1.82, same on master). That rule checks timestamp_timeout: exactly one non-negative Defaults timestamp_timeout= in /etc/sudoers or /etc/sudoers.d/, and no negative one (oval/shared.xml L16-L35). It does not look at !authenticate, which is what 4.3.4 is about.

Of the other CIS control files with a control of this title, eight select sudo_remove_no_authenticate (lines at v0.1.82):
rhel8 L1937,
rhel9 L1758,
rhel10 L1863,
fedora L1925,
ubuntu2204 L1746,
ubuntu2404 L1824,
debian12 L1799,
debian13 L1927.
#14067 moved RHEL 10's 5.2.5 to this rule, on the grounds that the requirement is only about removing !authenticate.

The one exception is controls/cis_almalinux9.yml, which has the same mapping as al2023 for 5.2.5 (L1732-L1739, same on master); I did not test AlmaLinux. (products/hummingbird/controls/cis_hummingbird.yml marks the control not applicable.)

Because no al2023 profile selects sudo_remove_no_authenticate, the build leaves it out of the al2023 data stream (rules no profile selects are dropped, ssg/build_yaml.py L608-L620). ssg-al2023-ds.xml 0.1.82 contains neither sudo_remove_no_authenticate nor sudo_require_authentication, so Defaults !authenticate is not checked by the al2023 CIS profiles at all.

The effect on 4.3.4:

  • Defaults !authenticate in a sudoers file passes 4.3.4, as long as timestamp_timeout is set.
  • A system without timestamp_timeout fails 4.3.4 even though re-authentication is not disabled; 4.3.4 only repeats 4.3.5.
SCAP Security Guide Version:

0.1.82 (release data stream ssg-al2023-ds.xml from scap-security-guide-0.1.82.zip). The control entries and both rules are unchanged on master at f9568564d3.

Operating System Version:

Amazon Linux 2023: amazonlinux:2023@sha256:74c545e3e04db388b00bd31d7cc5640d4e9c12058a6d72af938d113da3c82893 (linux/amd64), system-release 2023.12.20260831-0.amzn2023. OpenSCAP 1.4.4, oscap-chroot.

Steps to Reproduce:

The image's root filesystem (docker export of a container that was never started) is evaluated offline. /.dockerenv is removed, and empty noarch packages named kernel and sudo are registered in its rpm database (rpm --root root --dbpath /var/lib/rpm --justdb --nodeps --noscripts --notriggers --install ...), so that the system_with_kernel and package[sudo] platforms apply.

  1. Create root/etc/sudoers: 
    Defaults timestamp_timeout=15
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
@includedir /etc/sudoers.d
    and root/etc/sudoers.d/90-noauth: 
    Defaults !authenticate
  2. Evaluate: 
    sudo oscap-chroot root xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication \
  scap-security-guide-0.1.82/ssg-al2023-ds.xml
  3. Remove the timestamp_timeout line and 90-noauth, and evaluate again.
Actual Results:

Step 2 (re-authentication disabled for everyone):

Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication   Result  pass

Step 3 (re-authentication not disabled, no timestamp_timeout):

Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication   Result  fail

The rule's CIS references in the data stream are 4.3.4 and 4.3.5.

Expected Results:

4.3.4 fails when !authenticate is present in /etc/sudoers or /etc/sudoers.d/ and passes when it is absent, whatever timestamp_timeout is. 4.3.5 stays with sudo_require_reauthentication.

Additional Information/Debugging Steps:

Suggested fix, as #14067 did for RHEL 10:

--- a/controls/cis_al2023.yml
+++ b/controls/cis_al2023.yml
@@ -1283,7 +1283,7 @@
           - l1_server
       status: automated
       rules:
-          - sudo_require_reauthentication
+          - sudo_remove_no_authenticate
 
     - id: 4.3.5
       title: Ensure sudo authentication timeout is configured correctly (Automated)

I built al2023 from master (f9568564d3) with this change (the build also carried unrelated banner changes) and evaluated the same image. sudo_remove_no_authenticate is now in the data stream with the 4.3.4 reference, and sudo_require_reauthentication keeps only 4.3.5. Results with the release data stream and with the patched one:

sudoers 0.1.82: sudo_require_reauthentication (4.3.4, 4.3.5) patched: sudo_remove_no_authenticate (4.3.4) patched: sudo_require_reauthentication (4.3.5)
timestamp_timeout=15, Defaults !authenticate in sudoers.d pass fail pass
timestamp_timeout=15, no !authenticate pass pass pass
no timestamp_timeout, no !authenticate fail pass fail

oscap ds sds-validate accepts the patched data stream.

The same one-line change would apply to controls/cis_almalinux9.yml 5.2.5 (not tested).

Lingua principale
Shell
Stelle
2.8k
Fork
842
Merge medio
3g 22h
PR unite (30g)
57

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ComplianceAsCode/content

Tutte le issue di ComplianceAsCode/content

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.