# Ensure users must provide password for privilege escalation

Necessity: Requiring a password for privilege escalation via `sudo` is a fundamental security control. It enforces accountability and acts as a critical barrier against unauthorized actions. If a user account is compromised, this setting prevents an attacker from immediately gaining root or administrative privileges. Configuring `sudo` with `NOPASSWD` effectively bypasses this control, creating a significant security vulnerability that could lead to a full system compromise.

Auditing and Remediation: The audit script inspects all sudoers configuration files to detect the presence of the insecure `NOPASSWD` tag. The remediation script systematically removes this tag from any identified rules, thereby restoring the default and secure behavior that mandates password authentication before executing commands with elevated privileges.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Enabled'. This control is binary; either password authentication is required, or it is not. There is no secure middle ground. Basic security compliance, such as defined by CIS Benchmarks, mandates that passwordless `sudo` be disabled. Therefore, 'Enabled' is the only acceptable state for any secure environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that audits the sudoers configuration by parsing `/etc/sudoers` and all files within `/etc/sudoers.d/`. The script must check if any user or group configuration contains the `NOPASSWD` tag. If the `NOPASSWD` tag is found in any active configuration line, the script must return the string 'Disabled'. If no instances of the `NOPASSWD` tag are found, it must return 'Enabled'. The output must consist solely of the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'Enabled'. The script's function is to remove all instances of the `NOPASSWD` tag from user and group entries in `/etc/sudoers` and all files within `/etc/sudoers.d/`. The script must use a safe editing method, such as creating a temporary file and validating its syntax with `visudo -cf` before replacing the original. The script must return the boolean `true` upon successful completion and syntax validation, or `false` if an error occurs or the syntax check fails.

