← Back to Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

V-285677

CAT II (Medium)

Harvester Government must require users to reauthenticate for privilege escalation.

Rule ID

SV-285677r1272143_rule

STIG

Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002038

Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical that the user reauthenticate. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158

Check Content

Verify Harvester Government requires user authentication prior to execution of privileged commands through sudo.

1. Access Harvester Government using a privileged account and verify the sudoers configuration file exists:

ls -l /etc/sudoers

If /etc/sudoers does not exist, this is a finding.

2. Review the sudoers configuration for entries permitting passwordless execution of privileged commands:

grep -n "NOPASSWD" /etc/sudoers

3. Verify the command returns no output.

If entries containing "NOPASSWD" are present, this is a finding.

Fix Text

Ensure Harvester Government platform is running in its default configuration. 

1. Attempt to reboot the node to restore the original, immutable settings. Run the script again and check for failures.

2. If the check is still a finding, upgrade or reinstall Harvester Government platform in its default configuration.