# Ensure re-authentication for privilege escalation is not disabled globally

Necessity: Requiring re-authentication for privilege escalation is a critical security control. It ensures that a user must re-enter their password to execute commands with elevated privileges using `sudo`. This mitigates the risk of unauthorized actions if a user's authenticated session is compromised or they leave a terminal unattended. Disabling this feature globally would allow any process running as the user to gain root access without any further checks, creating a significant security vulnerability.
Auditing and Remediation: The audit script checks the `sudo` configuration files (`/etc/sudoers` and included files in `/etc/sudoers.d/`) to verify if the `!authenticate` option has been set in the `Defaults` entry, which would disable the password prompt. The remediation script directly modifies these configurations by either removing/commenting out the `Defaults !authenticate` line to enforce re-authentication ('Enabled') or adding it to disable the control ('Disabled').
Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Enabled'. This is a foundational security best practice aligned with the Principle of Least Privilege. There is no secure scenario where disabling password verification for privilege escalation globally is advisable. Therefore, Basic, Moderate, and Strict configurations all mandate that re-authentication must be enabled to maintain a secure system posture. Any exceptions should be granular, temporary, and applied to specific users or commands with strong justification, not as a global default.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the /etc/sudoers file and all files within the /etc/sudoers.d/ directory. The script must check for the presence of an uncommented `Defaults !authenticate` directive. If found, the script shall output the string 'Disabled'. If not found, it shall output 'Enabled'. The output must contain only the resulting string value and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must find any uncommented line containing `Defaults !authenticate` within /etc/sudoers or /etc/sudoers.d/* and comment it out or remove it. If the argument is 'Disabled', the script must add the line `Defaults !authenticate` to a configuration file within /etc/sudoers.d/. The script must return the string `true` upon successful modification or if the system is already in the desired state, and `false` if the operation fails.

