Require a password for every sudo rule

Description

A sudo rule tagged NOPASSWD: runs commands without asking the user for their password.

Debian cloud images get a NOPASSWD:ALL rule for the default user from cloud-init, in /etc/sudoers.d/90-cloud-init-users. Set a password for that user before removing the rule.

Rationale

The password prompt is the last barrier between a stolen session or a compromised process running as an administrator and full control of the system. Without it, privilege escalation needs no secret at all.

Impact

Automation that relies on password-less sudo (configuration management, deployment accounts) needs another approach: a dedicated account restricted to precise commands, run from a controlled host, or root access through SSH keys for that tool only.

Applies when

Detected: when: sudo is installed A scanner reports the control not applicable when one is false.

Audit

Run grep -r NOPASSWD /etc/sudoers /etc/sudoers.d/. There must be no match.

Automated: every check must pass. Scanners report each check by its id.

sudoers

No NOPASSWD tag in /etc/sudoers.

path: /etc/sudoers
pattern: ^[^#]*NOPASSWD
expect: no_match

sudoers-d

No NOPASSWD tag in /etc/sudoers.d/.

path: /etc/sudoers.d/*
pattern: ^[^#]*NOPASSWD
expect: no_match

Remediation

1. Make sure every user concerned has a password (passwd <user>) and can still run sudo -v.
2. Edit the files with visudo (or visudo -f /etc/sudoers.d/<file>) and remove NOPASSWD: from each rule.

Rollback

Add the NOPASSWD: tag back with visudo.

References

• sudoers(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R39) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle