# Ensure sudo authentication timeout is configured correctly

The sudo authentication timeout determines how long a user's `sudo` authentication is cached after they enter their password. If this value is too high, it creates a significant security risk. An attacker who gains temporary physical or remote access to an authenticated user's session can execute privileged commands without re-authentication. Configuring a short timeout minimizes this window of opportunity, thereby mitigating the risk of unauthorized privilege escalation. The audit script verifies the current effective timeout value in minutes. The remediation script securely modifies the sudo configuration to enforce a new timeout value. The Basic state of 5 minutes offers a balance between security and usability. The Moderate state of 1 minute significantly increases security for environments where administrative sessions may be interrupted. The Strict state of 0, recommended by CIS benchmarks, provides the highest level of security by requiring a password for every sudo command, completely eliminating the risk of session hijacking.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[5, 0]` |
| **Moderate** | `[1, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the effective sudo authentication timestamp timeout value. The script must parse the output of `sudo -V | grep "Authentication timestamp timeout"` to isolate and return only the numerical timeout value in minutes. For example, if the timeout is 15 minutes, the script should output only `15`.

## Remediation Script Working

Bash script that accepts a single numerical argument representing the desired sudo authentication timeout in minutes. The script must create or modify a configuration file in `/etc/sudoers.d/` to set `Defaults timestamp_timeout` to the provided value. The script should use `visudo -c` to validate the syntax before saving. It must return `true` on successful application and `false` on failure.

