# Ensure sudo authentication timeout is configured correctly

Necessity: The sudo authentication timeout (`timestamp_timeout`) defines the period for which a user's successful authentication is cached. If this timeout is too long, it creates a significant security risk. An attacker who gains physical or remote access to an authenticated but unattended user session could execute commands with elevated privileges without needing to re-enter a password. Properly configuring this timeout is crucial for minimizing the window of opportunity for such privilege escalation attacks.

Auditing and Remediation: The audit script is designed to inspect the effective `sudo` configuration to determine the current value of the authentication timestamp timeout. The remediation script modifies this setting in a safe and standard way by adding a dedicated configuration file to the `/etc/sudoers.d/` directory. This approach avoids direct modification of the main `/etc/sudoers` file, making the change modular and easier to manage.

Recommended State Rationale:
- Basic: `[5, 5]` minutes. This is the default value for most `sudo` implementations and offers a reasonable balance between security and user convenience. It allows a user to perform a series of related administrative tasks without being prompted for a password for each command.
- Moderate: `[1, 1]` minute. This provides a heightened level of security by significantly reducing the time an authenticated session remains open. It is suitable for environments with multiple users or where workstations may be left unattended, reducing the risk of session hijacking.
- Strict: `[0, 0]` minutes. This is the most secure configuration. A value of `0` forces re-authentication for every single `sudo` command, completely eliminating the risk associated with a cached credential. This state is recommended for high-security environments or systems subject to stringent compliance requirements, as it enforces explicit authorization for every privileged action.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 0]` |
| **Moderate** | `[1, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that executes `sudo sudo -V` and pipes the output to `grep 'Authentication timestamp timeout'`. The script must parse this output to extract only the numeric value representing the timeout in minutes and print it to standard output.

## Remediation Script Working

Bash script that accepts a single integer argument representing the desired sudo authentication timeout in minutes. The script should create or modify a configuration file in `/etc/sudoers.d/` (e.g., `/etc/sudoers.d/99-custom-timeout`) to set `Defaults timestamp_timeout` to the provided value. The script must ensure the new file has permissions of `0440`. It should return `true` on successful modification and `false` otherwise.

