# Ensure users must provide password for privilege escalation

Necessity: Requiring a password for privilege escalation via 'sudo' is a fundamental security control. It prevents unauthorized actions if a user's logged-in session is compromised by an attacker or malware. This setting acts as a critical checkpoint, forcing the user to consciously confirm a privileged action, which mitigates the risk of accidental or malicious commands being executed with root permissions. Misconfiguring this by allowing 'NOPASSWD' effectively removes this layer of protection, creating a direct path for attackers to gain full system control from a compromised user account. Auditing and Remediation: The audit script inspects all sudoers configuration files to detect the presence of the 'NOPASSWD' tag, which signifies that password-less privilege escalation is allowed. The remediation script programmatically removes these 'NOPASSWD' tags from the configuration files, thereby enforcing the default, secure behavior of requiring a password for all 'sudo' commands. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Enabled'. This control is binary; either a password is required for 'sudo' or it is not. There is no secure middle ground. The 'Enabled' state aligns with the principle of least privilege and is a universal recommendation in security benchmarks like CIS. Any deviation from this introduces significant risk, making 'Enabled' the only acceptable configuration for a securely hardened system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the /etc/sudoers file and all files in the /etc/sudoers.d/ directory for any active (non-commented) line containing the 'NOPASSWD' tag. If any such line is found, the script must return the string 'Disabled'. If no such lines are found, it must return 'Enabled'. The output must consist solely of the resulting string.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired state ('Enabled'). If the argument is 'Enabled', the script must scan /etc/sudoers and all files in /etc/sudoers.d/ for any active (non-commented) occurrences of the 'NOPASSWD' tag and remove them. The script must return 'true' on successful modification or if no changes were needed, and 'false' if it encounters an error.

