Install sudo for administrative access

Description

sudo lets authorized users run commands as root (or another user) with their own password, according to rules in /etc/sudoers and /etc/sudoers.d/. Every command is logged with the name of the user who ran it.

Rationale

Administration through personal accounts and sudo replaces a shared root password, gives each administrator only the rights they need, and leaves an audit trail that names who did what.

Impact

None known. Debian installs sudo when no root password is set during installation, and the cloud images ship it.

Audit

Run dpkg -s sudo. The package must be installed.

Automated: every check must pass. Scanners report each check by its id.

package

The sudo package is installed.

name: sudo
state: installed

Remediation

Run apt install sudo, then grant administrators access by adding them to the sudo group.

install

Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• sudo(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R33) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle