# Ensure sudo commands use pty

Necessity: Forcing sudo commands to run in a pseudo-terminal (pty) is a critical security enhancement. It prevents session hijacking attacks where a malicious program could otherwise feed input into a privileged sudo process that is not attached to a real terminal. This isolation ensures that sudo sessions behave like interactive logins, which also significantly improves the quality of session logging for forensic purposes. Misconfiguration leaves a vector open for privilege escalation. Auditing and Remediation: The audit script checks the sudo configuration files to determine if the `use_pty` default is set. The remediation script adds this configuration directive to a dedicated file under `/etc/sudoers.d/`, which is the standard, non-destructive way to manage sudo settings. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'enabled'. This is a binary, foundational security setting. There is no security benefit to disabling it, and its enablement is a universal best practice recommended by security frameworks like the CIS Benchmarks. Because it closes a direct vulnerability without impacting system functionality, it is considered a mandatory setting for any level of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the effective sudo configuration by checking `/etc/sudoers` and all files within `/etc/sudoers.d/`. The script should determine if the `use_pty` setting is enabled. If `Defaults use_pty` is found and active, the script must return only the string `enabled`. If it is not found or is negated (e.g., `!use_pty`), it must return only the string `disabled`.

## Remediation Script Working

Bash script that accepts a single positional argument: `enabled` or `disabled`. If the argument is `enabled`, the script must add the line `Defaults use_pty` to a new configuration file in `/etc/sudoers.d/` to enforce the setting system-wide. If the argument is `disabled`, it should remove the corresponding line or file. The script must return `true` on success and `false` on failure.

