OpenControls Logo

STIG Viewer

STIGViewer Support

AIX must remove NOPASSWD tag from sudo config files.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-215260AIX7-00-002061SV-215260r1050789_ruleCCI-004895high
Description
sudo command does not require reauthentication if NOPASSWD tag is specified in /etc/sudoers config file, or sudoers files in /etc/sudoers.d/ directory. With this tag in sudoers file, users are not required to reauthenticate for privilege escalation.
STIGDate
IBM AIX 7.x Security Technical Implementation Guide2026-02-06

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
CRY-03Transmission Confidentiality
1.00
CRY-04Transmission Integrity
1.00
DCH-01Data Protection
1.00
END-09Trusted Path
1.00
IAC-21Least Privilege
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-3(4)Discretionary Access Control
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
IA-11Re-authentication
1.00
IA-5(13)Expiration of Cached Authenticators
1.00
SC-10Network Disconnect
1.00
SC-11Trusted Path
1.00
CCI1 mapping
CCI-004895
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-02
1.00
PR.DS-10
1.00

Who does this work

8 NICE work roles and 7 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-215260r1050789_chk)

If sudo is not used on AIX, this is Not Applicable. Run the following command to find the "NOPASSWD" tag in "/etc/sudoers" file: # grep NOPASSWD /etc/sudoers If there is a "NOPASSWD" tag found in "/etc/sudoers" file, this is a finding. Run the following command to find the "NOPASSWD" tag in one of the sudo config files in "/etc/sudoers.d/" directory: # find /etc/sudoers.d -type f -exec grep -l NOPASSWD {} \; The above command displays all sudo config files that are in "/etc/sudoers.d/" directory and they contain the "NOPASSWD" tag. If above command found a config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tag, this is a finding.

Fix Text (F-16456r294232_fix)

Edit "/etc/sudoers" using "visudo" command to remove all the "NOPASSWD" tags: # visudo -f Editing a sudo config file that is in "/etc/sudoers.d/" directory and contains the "NOPASSWD" tags, use "visudo" the command as follows: # visudo -f /etc/sudoers.d/<config_file_name>