Configure sudo to use a pseudo-terminal, a log file and a short credential cache

Description

Three sudo defaults, set with Defaults lines in /etc/sudoers or /etc/sudoers.d/:

• use_pty: run each command in a new pseudo-terminal, so it cannot inject input into the user's terminal after sudo exits;
• logfile: write every sudo command to a dedicated file, in addition to syslog;
• timestamp_timeout: how many minutes a successful authentication is cached before sudo asks for the password again.

Debian already sets use_pty in /etc/sudoers and caches credentials for 15 minutes. The effective values are read with sudo -V as root, which merges every sudoers file.

Rationale

Without use_pty, a malicious program run through sudo can keep running in the background and push keystrokes into the user's shell. A dedicated log file keeps a readable record of privileged commands even if syslog is lost or flooded. A short cache limits how long an unattended terminal can run privileged commands without a password.

Impact

Some interactive programs behave differently in a pseudo-terminal (rare). Users type their password again after {{ timestamp_timeout }} minutes of not using sudo.

Applies when

Detected: when: sudo is installed A scanner reports the control not applicable when one is false.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run sudo -V as root and check that:

1. it prints Always run commands in a pseudo-tty;
2. Path to log file: is set;
3. Authentication timestamp timeout: is at most {{ timestamp_timeout }} minutes.

Automated: every check must pass. Scanners report each check by its id.

use-pty

sudo runs commands in a pseudo-terminal.

script: |
  sudo -V 2>/dev/null | grep -q 'Always run commands in a pseudo-tty' || { echo "use_pty not set"; exit 1; }
  echo "use_pty set"

logfile

sudo writes to a log file.

script: |
  f=$(sudo -V 2>/dev/null | sed -n 's/^Path to log file: //p')
  echo "logfile=${f:-none}"
  [ -n "$f" ]

timeout

sudo credential cache lifetime.

script: |
  t=$(sudo -V 2>/dev/null | sed -n 's/^Authentication timestamp timeout: \([0-9-]*\).*/\1/p')
  echo "timestamp_timeout=${t:-unknown} minutes"
  [ -n "$t" ] || exit 3
  [ "$t" -ge 0 ] && [ "$t" -le "$CB_TIMESTAMP_TIMEOUT" ]

Remediation

Create /etc/sudoers.d/60-cirsec with visudo -f /etc/sudoers.d/60-cirsec:

Defaults use_pty
Defaults logfile="{{ log_file }}"
Defaults timestamp_timeout={{ timestamp_timeout }}

Remove any timestamp_timeout with a higher value from other sudoers files.

Rollback

Delete /etc/sudoers.d/60-cirsec.

dropin

f=/etc/sudoers.d/60-cirsec
t=$(mktemp)
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUTH-005' 'Defaults use_pty' \
  "Defaults logfile=\"$CB_LOG_FILE\"" "Defaults timestamp_timeout=$CB_TIMESTAMP_TIMEOUT" >"$t"
if ! visudo -cqf "$t"; then rm -f "$t"; echo "invalid sudoers drop-in" >&2; exit 1; fi
cb_backup "$f"
install -m 0440 -o root -g root "$t" "$f"
rm -f "$t"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• sudoers(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R39) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle