# Ensure sudo commands use pty

Necessity: The 'use_pty' setting in the sudoers configuration forces commands run via sudo to execute within a new pseudo-terminal (PTY). This is a critical security enhancement that mitigates several risks. It prevents malicious programs from performing TTY hijacking attacks, where they could otherwise interact with the user's original terminal session to gain unauthorized access or information. Furthermore, it ensures that security and session logging are more robust, as all actions are properly associated with a dedicated PTY, simplifying auditing and incident response. Without this setting, it can be difficult to monitor or terminate suspicious sudo sessions effectively.

Auditing and Remediation: The audit script inspects the sudoers configuration files (`/etc/sudoers` and `/etc/sudoers.d/*`) to verify whether the 'Defaults use_pty' directive is present and active. The remediation script modifies this configuration by adding or removing the 'Defaults use_pty' line, typically within a separate file in `/etc/sudoers.d/` to ensure safe and modular management of sudo policies.

Recommended State Rationale: 
- Basic: ['true'] - Enabling `use_pty` is a foundational security best practice (e.g., recommended in CIS Benchmarks) with no significant performance overhead. It provides essential protection against session-based attacks.
- Moderate: ['true'] - There is no intermediate state for this setting. Maintaining it as enabled is standard for a moderately hardened system.
- Strict: ['true'] - For a strictly secured environment, enabling `use_pty` is mandatory. There is no security benefit to disabling it, so the most secure state is to have it enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the `/etc/sudoers` file and all files in the `/etc/sudoers.d/` directory for the `use_pty` setting. The script should parse these files to determine if `Defaults use_pty` is actively configured. The script must output only the string 'true' if the setting is active and 'false' if it is not. No other text or labels should be included in the output.

## Remediation Script Working

shell script that accepts a single positional command-line argument, which will be either 'true' or 'false'. If the argument is 'true', the script must ensure the setting `Defaults use_pty` is active, preferably by adding it to a dedicated file in the `/etc/sudoers.d/` directory. If the setting already exists, no change is needed. If the argument is 'false', the script should disable the setting by removing the `Defaults use_pty` line from the configuration. The script must return the string 'true' upon successful application of the state, or 'false' if it fails.

