# Ensure re-authentication for privilege escalation is not disabled globally

Necessity: The `sudo` command allows a permitted user to execute a command as the superuser or another user. By default, after a user authenticates with their password, a timestamp is recorded, allowing them to use `sudo` without a password for a short period (typically 15 minutes). Disabling this re-authentication timeout (`timestamp_timeout=-1`) creates a significant security risk. If a user leaves their session unattended, an attacker could gain privileged access immediately and execute commands as root without needing to know the user's password. Enforcing a timeout is a critical defense-in-depth measure against the misuse of authenticated but unattended user sessions.

Auditing and Remediation: The audit script checks the effective `timestamp_timeout` value by parsing the sudoers configuration files. This ensures an accurate view of the currently applied policy. The remediation script securely sets the desired timeout by creating a dedicated configuration file in `/etc/sudoers.d/`. This is the recommended, non-destructive method for applying local system customizations, as it avoids direct modification of the main `/etc/sudoers` file and ensures local settings take precedence.

Recommended State Rationale:
- **Basic ([15, 15]):** This enforces the common default value. A 15-minute timeout provides a reasonable balance between user convenience and security, ensuring that an unattended session's privileged access expires after a moderate period.
- **Moderate ([5, 5]):** A 5-minute timeout significantly reduces the window of opportunity for an attacker to exploit a logged-in session. It is suitable for environments that require a higher level of security than the default, without being overly intrusive for administrators performing series of related tasks.
- **Strict ([0, 0]):** This is the most secure configuration. Setting the timeout to `0` forces password re-authentication for every `sudo` command. This completely mitigates the risk associated with unattended sessions and enforces the principle of least privilege on a per-command basis. It is highly recommended for systems in high-security environments or for accounts with critical administrative access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[15, 0]` |
| **Moderate** | `[5, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the sudoers configuration (in `/etc/sudoers` and `/etc/sudoers.d/*`) to find the effective `timestamp_timeout` value for the `Defaults` entry. The script should correctly handle multiple declarations by using the last one found. It must output only the final numeric value of the timeout. If not explicitly set, it should return the default value, which is `15`.

## Remediation Script Working

Bash script that accepts a single integer as a command-line argument. This integer will be the new `timestamp_timeout` value. The script must create or modify a file (e.g., `/etc/sudoers.d/99-reauth-timeout`) to set `Defaults timestamp_timeout` to the provided value. The script must ensure the configuration file has permissions set to `0440`. It must return `true` on successful application of the setting, or `false` on failure.

