Never disable authentication for sudo globally

Description

The !authenticate default turns off password checks for every rule it applies to. Unlike a NOPASSWD: tag on one rule, it is easy to miss because it sits in a Defaults line.

sudo-rs, the sudo of Ubuntu 26.04, does not know the authenticate setting: its visudo rejects the line. The check still applies, since the original sudo stays installed and can be selected again through the sudo alternative.

Rationale

A global !authenticate silently turns every administrator account into a password-less root account: stealing any of their sessions is enough to control the system.

Impact

None for a standard configuration. Ubuntu does not set it.

Applies when

Detected: when: A sudo command is installed (sudo or sudo-rs) A scanner reports the control not applicable when one is false.

Audit

Run grep -r '!authenticate' /etc/sudoers /etc/sudoers.d/. There must be no match.

Automated: every check must pass. Scanners report each check by its id.

sudoers

No !authenticate in /etc/sudoers.

path: /etc/sudoers
pattern: ^[^#]*!\s*authenticate
expect: no_match

sudoers-d

No !authenticate in /etc/sudoers.d/.

path: /etc/sudoers.d/*
pattern: ^[^#]*!\s*authenticate
expect: no_match

Remediation

Remove every Defaults ... !authenticate entry with visudo (or visudo -f for files in /etc/sudoers.d/).

Rollback

Add the entry back with visudo.

References

• sudoers(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R39) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle