From 7e564ab00c07d31012bb2cede57b0c7f3cd28c76 Mon Sep 17 00:00:00 2001

From: yarunachalam <yarunachalam@suse.com>

Date: Thu, 22 Apr 2021 18:58:28 +0000

Subject: [PATCH 1/6] Add Rule,Test for SLES-15-020103

Rule has no remediation.

---

 .../sudoers_validate_passwd/oval/shared.xml   | 44 ++++++++++++++++++

 .../sudo/sudoers_validate_passwd/rule.yml     | 45 +++++++++++++++++++

 .../tests/sudoers_validate_passwd_fail.sh     |  7 +++

 .../tests/sudoers_validate_passwd_pass.sh     |  6 +++

 .../tests/sudoers_validate_rootpw_fail.sh     |  7 +++

 .../tests/sudoers_validate_runaspw_fail.sh    |  7 +++

 .../tests/sudoers_validate_targetpw_fail.sh   |  7 +++

 8 files changed, 125 insertions(+)

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh

 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

new file mode 100644

index 00000000000..3f33b82b520

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

@@ -0,0 +1,44 @@

+<def-group>

+  <definition class="compliance" id="sudoers_validate_passwd" version="1">

+   {{{ oval_metadata("Ensure invoking user's password for privilege escalation when using sudo") }}}

+      <criteria operator="AND">

+      <criterion comment="Check Defaults !targetpw exists in /etc/sudoers file" test_ref="test_sudoers_targetpw_config" />

+      <criterion comment="Check Defaults !rootpw exists in /etc/sudoers file" test_ref="test_sudoers_rootpw_config" />

+      <criterion comment="Check Defaults !runaspw exists in /etc/sudoers file" test_ref="test_sudoers_runaspw_config" />

+      </criteria>

+  </definition>

+

+  

+  id="test_sudoers_targetpw_config" version="1">

+    <ind:object object_ref="object_test_sudoers_targetpw_config" />

+  </ind:textfilecontent54_test>

+

+  

+  id="test_sudoers_rootpw_config" version="1">

+    <ind:object object_ref="object_test_sudoers_rootpw_config" />

+  </ind:textfilecontent54_test>

+

+  

+  id="test_sudoers_runaspw_config" version="1">

+    <ind:object object_ref="object_test_sudoers_runaspw_config" />

+  </ind:textfilecontent54_test>

+

+  <ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">

+    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>

+    <ind:instance datatype="int">1</ind:instance>

+  </ind:textfilecontent54_object>

+

+  <ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">

+    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>

+    <ind:instance datatype="int">1</ind:instance>

+  </ind:textfilecontent54_object>

+

+  <ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">

+    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>

+    <ind:instance datatype="int">1</ind:instance>

+  </ind:textfilecontent54_object>

+

+</def-group>

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

new file mode 100644

index 00000000000..cf564c6b533

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

@@ -0,0 +1,45 @@

+documentation_complete: true

+

+title: 'Ensure invoking users password for privilege escalation when using sudo'

+

+prodtype: sle15

+

+description: |-

+    The sudoers security policy requires that users authenticate themselves before they can use sudo.

+    When sudoers requires authentication, it validates the invoking user's credentials.

+severity: medium

+

+rationale: |-

+    If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt

+    the invoking user for the "root" user password.

+

+identifiers:

+    cce@sle15: CCE-85747-4

+

+references:

+    disa@sle15: CCI-000366

+    nist@sle15: CM-6(b),CM-6.1(iv)

+    srg: SRG-OS-000480-GPOS-00227

+    stigid@sle15: SLES-15-020103

+

+ocil_clause: 'invoke user passwd when using sudo'

+

+ocil: |-

+    To Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.

+

+    
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

+

+    
 /etc/sudoers:Defaults !targetpw

+          /etc/sudoers:Defaults !rootpw

+          /etc/sudoers:Defaults !runaspw 

+

+    If no results are returned, this is a finding

+    If "Defaults !targetpw" is not defined, this is a finding.

+    If "Defaults !rootpw" is not defined, this is a finding.

+    If "Defaults !runaspw" is not defined, this is a finding.

+

+    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:

+

+    Defaults !targetpw

+    Defaults !rootpw

+    Defaults !runaspw

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh

new file mode 100644

index 00000000000..d8b33a0ac52

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh

@@ -0,0 +1,7 @@

+# platform = SUSE Linux Enterprise 15

+# packages = sudo

+

+if [ $(sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]

+then

+     sed -i '/Defaults !targetpw/{:a;N;/Defaults !runaspw/!ba};/Defaults !rootpw/d' /etc/sudoers

+fi

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh

new file mode 100644

index 00000000000..f2461085f99

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh

@@ -0,0 +1,6 @@

+# platform = SUSE Linux Enterprise 15

+# packages = sudo

+

+echo 'Defaults !targetpw' >> /etc/sudoers

+echo 'Defaults !rootpw' >> /etc/sudoers

+echo 'Defaults !runaspw' >> /etc/sudoers

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh

new file mode 100644

index 00000000000..9a8f51450cd

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh

@@ -0,0 +1,7 @@

+# platform = SUSE Linux Enterprise 15

+# packages = sudo

+

+if [ $(sudo egrep -i '(!rootpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]

+then

+     sed -i '/Defaults !rootpw/d' /etc/sudoers

+fi

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh

new file mode 100644

index 00000000000..a455aa14968

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh

@@ -0,0 +1,7 @@

+# platform = SUSE Linux Enterprise 15

+# packages = sudo

+

+if [ $(sudo egrep -i '(!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]

+then

+     sed -i '/Defaults !runaspw/d' /etc/sudoers

+fi

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh

new file mode 100644

index 00000000000..1b18a8f3dc5

--- /dev/null

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh

@@ -0,0 +1,7 @@

+# platform = SUSE Linux Enterprise 15

+# packages = sudo

+

+if [ $(sudo egrep -i '(!targetpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]

+then

+     sed -i '/Defaults !targetpw/d' /etc/sudoers

+fi

From d691e2d0183c0254e0d2a095853db373247691ef Mon Sep 17 00:00:00 2001

From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>

Date: Fri, 23 Apr 2021 17:09:38 +0000

Subject: [PATCH 2/6] Update

 linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

Co-authored-by: vojtapolasek <krecoun@gmail.com>

---

 .../guide/system/software/sudo/sudoers_validate_passwd/rule.yml | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

index cf564c6b533..2ac2153d546 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

@@ -25,7 +25,7 @@ references:

 ocil_clause: 'invoke user passwd when using sudo'

 ocil: |-

-    To Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.

+    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:

     
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

From eb314afa0554ae9badd47bc218f79e6f276fdc79 Mon Sep 17 00:00:00 2001

From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>

Date: Fri, 23 Apr 2021 17:20:57 +0000

Subject: [PATCH 3/6] Apply suggestions from code review

Co-authored-by: vojtapolasek <krecoun@gmail.com>

---

 .../software/sudo/sudoers_validate_passwd/oval/shared.xml     | 4 ++--

 .../system/software/sudo/sudoers_validate_passwd/rule.yml     | 2 +-

 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

index 3f33b82b520..1c3a83523c6 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

@@ -30,13 +30,13 @@

   </ind:textfilecontent54_object>

   <ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">

-    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>

     <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>

     <ind:instance datatype="int">1</ind:instance>

   </ind:textfilecontent54_object>

   <ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">

-    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>

     <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>

     <ind:instance datatype="int">1</ind:instance>

   </ind:textfilecontent54_object>

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

index 2ac2153d546..e420e5aa151 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

@@ -28,7 +28,7 @@ ocil: |-

     Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:

     
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

-

+The expected output is:

     
 /etc/sudoers:Defaults !targetpw

           /etc/sudoers:Defaults !rootpw

           /etc/sudoers:Defaults !runaspw 

From 8b4ae0c13a4992db2e908e1380b81b4d6cbacee1 Mon Sep 17 00:00:00 2001

From: yarunachalam <yarunachalam@suse.com>

Date: Fri, 23 Apr 2021 18:27:03 +0000

Subject: [PATCH 4/6] Updated review comments:

- Fixed disa record and removed blank line.

- Renamed test case file name according the to the format

- Removed susefirewall2_only_required_services stig from sle15 profile

---

 .../software/sudo/sudoers_validate_passwd/rule.yml | 14 ++++++--------

 ...swd_fail.sh => sudoers_validate_passwd.fail.sh} |  0

 ...swd_pass.sh => sudoers_validate_passwd.pass.sh} |  0

 ...tpw_fail.sh => sudoers_validate_rootpw.fail.sh} |  0

 ...pw_fail.sh => sudoers_validate_runaspw.fail.sh} |  0

 ...w_fail.sh => sudoers_validate_targetpw.fail.sh} |  0

 7 files changed, 6 insertions(+), 9 deletions(-)

 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_passwd_fail.sh => sudoers_validate_passwd.fail.sh} (100%)

 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_passwd_pass.sh => sudoers_validate_passwd.pass.sh} (100%)

 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_rootpw_fail.sh => sudoers_validate_rootpw.fail.sh} (100%)

 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_runaspw_fail.sh => sudoers_validate_runaspw.fail.sh} (100%)

 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_targetpw_fail.sh => sudoers_validate_targetpw.fail.sh} (100%)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

index e420e5aa151..db636bc59a2 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

@@ -7,6 +7,11 @@ prodtype: sle15

 description: |-

     The sudoers security policy requires that users authenticate themselves before they can use sudo.

     When sudoers requires authentication, it validates the invoking user's credentials.

+    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:

+    Defaults !targetpw

+    Defaults !rootpw

+    Defaults !runaspw

+

 severity: medium

 rationale: |-

@@ -17,7 +22,7 @@ identifiers:

     cce@sle15: CCE-85747-4

 references:

-    disa@sle15: CCI-000366

+    disa: CCI-000366

     nist@sle15: CM-6(b),CM-6.1(iv)

     srg: SRG-OS-000480-GPOS-00227

     stigid@sle15: SLES-15-020103

@@ -26,7 +31,6 @@ ocil_clause: 'invoke user passwd when using sudo'

 ocil: |-

     Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:

-

     
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

 The expected output is:

     
 /etc/sudoers:Defaults !targetpw

@@ -37,9 +41,3 @@ The expected output is:

     If "Defaults !targetpw" is not defined, this is a finding.

     If "Defaults !rootpw" is not defined, this is a finding.

     If "Defaults !runaspw" is not defined, this is a finding.

-

-    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:

-

-    Defaults !targetpw

-    Defaults !rootpw

-    Defaults !runaspw

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh

similarity index 100%

rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh

rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh

similarity index 100%

rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh

rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh

similarity index 100%

rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh

rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh

similarity index 100%

rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh

rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh

similarity index 100%

rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh

rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh

From dfd5d60cb3ef52692e175efe52076495471db994 Mon Sep 17 00:00:00 2001

From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>

Date: Fri, 23 Apr 2021 18:32:31 +0000

Subject: [PATCH 5/6] Apply suggestions from code review

Co-authored-by: vojtapolasek <krecoun@gmail.com>

---

 .../software/sudo/sudoers_validate_passwd/oval/shared.xml       | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

index 1c3a83523c6..646e6bfb7c0 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml

@@ -24,7 +24,7 @@

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">

-    <ind:filepath>/etc/sudoers</ind:filepath>

+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>

     <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>

     <ind:instance datatype="int">1</ind:instance>

   </ind:textfilecontent54_object>

From 244471e24f9e90dd5ef54530f517b1759c87a01f Mon Sep 17 00:00:00 2001

From: yarunachalam <yarunachalam@suse.com>

Date: Fri, 23 Apr 2021 19:18:20 +0000

Subject: [PATCH 6/6] Fixed ocil record

---

 .../sudo/sudoers_validate_passwd/rule.yml        | 16 ++++++----------

 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

index db636bc59a2..d0a90a3723a 100644

--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

@@ -7,10 +7,11 @@ prodtype: sle15

 description: |-

     The sudoers security policy requires that users authenticate themselves before they can use sudo.

     When sudoers requires authentication, it validates the invoking user's credentials.

-    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:

-    Defaults !targetpw

-    Defaults !rootpw

-    Defaults !runaspw

+    The expected output for:

+    
sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

+    
 /etc/sudoers:Defaults !targetpw

+          /etc/sudoers:Defaults !rootpw

+          /etc/sudoers:Defaults !runaspw 

 severity: medium

@@ -30,13 +31,8 @@ references:

 ocil_clause: 'invoke user passwd when using sudo'

 ocil: |-

-    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:

+    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:

     
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'

-The expected output is:

-    
 /etc/sudoers:Defaults !targetpw

-          /etc/sudoers:Defaults !rootpw

-          /etc/sudoers:Defaults !runaspw 

-

     If no results are returned, this is a finding

     If "Defaults !targetpw" is not defined, this is a finding.

     If "Defaults !rootpw" is not defined, this is a finding.