Install sudo for administrative access

Description

sudo lets authorized users run commands as root (or another user) with their own password, according to rules in /etc/sudoers and /etc/sudoers.d/. Every command is logged with the name of the user who ran it.

Since Ubuntu 25.10, the sudo command is provided by sudo-rs, a reimplementation in Rust, selected through the sudo alternative; the original sudo package stays installed. Either package meets this control.

Rationale

Administration through personal accounts and sudo replaces a shared root password, gives each administrator only the rights they need, and leaves an audit trail that names who did what.

Impact

None known. Ubuntu installs sudo on every server, desktop and cloud image.

Audit

Run dpkg -s sudo sudo-rs. At least one of the two packages must be installed.

Automated: at least one check must pass. Scanners report each check by its id.

package

The sudo package is installed.

name: sudo
state: installed

package-rs

The sudo-rs package is installed.

name: sudo-rs
state: installed

Remediation

Run apt install sudo, then grant administrators access by adding them to the sudo group.

install

Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• sudo(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• sudo-rs(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R33) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle