AlmaLinux OS 9 must restrict privilege elevation to authorized personnel.

STIG ID: ALMA-09-017290 |  SRG: SRG-OS-000480-GPOS-00227 |  Severity: medium |  CCI:  | Vulnerability Id: V-269232

Vulnerability Discussion

If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.

Check

Remove the following entries from the /etc/sudoers file or configuration files under /etc/sudoers.d/ (including NOPASSWD equivalents):

ALL ALL=(ALL) ALL
ALL ALL=(ALL:ALL) ALL

Fix

Verify AlmaLinux OS 9 restricts privilege elevation to authorized personnel with the following command:

$ grep -w ALL /etc/sudoers /etc/sudoers.d/* | grep -v '#'

/etc/sudoers:root ALL=(ALL) ALL
/etc/sudoers:%wheel ALL=(ALL) NOPASSWD: ALL

If the either of the following entries are returned, including their NOPASSWD equivalents, this is a finding:
ALL ALL=(ALL) ALL
ALL ALL=(ALL:ALL) ALL