The Photon operating system must require users to reauthenticate for privilege escalation.

Without reauthentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.

Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

At the command line, run the following commands to verify users with a set password are not allowed to sudo without reauthentication:

# grep -ihs nopasswd /etc/sudoers /etc/sudoers.d/*|grep -vE '(^#|^%)'

# awk -F: '($2 != "x" && $2 != "!") {print $1}' /etc/shadow

If any account listed in the first output is also listed in the second output and is not documented, this is a finding.

Check the configuration of the "/etc/sudoers" and "/etc/sudoers.d/*" files with the following command:

# visudo

OR

# visudo -f /etc/sudoers.d/<file name>

Remove any occurrences of "NOPASSWD" tags associated with user accounts with a password hash.