---
title: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Ensure Users Re-Authenticate for
  Privilege Escalation - sudo !authenticate
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
 
## Description{% #description %}

The sudo `!authenticate` option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the `!authenticate` option does not exist in `/etc/sudoers` configuration file or any sudo configuration snippets in `/etc/sudoers.d/`.

## Rationale{% #rationale %}

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then

for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -f "$f" ] ; then
    continue
  fi
  # The entries that hold "!authenticate", as first:last line numbers. A
  # trailing backslash continues an entry, and a comment ends at its line.
  entries=$(awk '{
      if (c) { t = t " " $0 } else { s = NR; t = $0; k = /^[[:space:]]*#/ }
      c = !k && /\\$/
      if (c) { sub(/\\$/, "", t) } else { print s ":" NR ":" t }
    } END { if (c) print s ":" NR ":" t }' "$f" |
    grep -P '^\d+:\d+:(?!#).*[\s,=):]\!authenticate' | cut -d: -f1,2)
  if [ -z "$entries" ] ; then
    continue
  fi
  # The copy sits beside the file, so visudo resolves relative includes.
  tmp=$(mktemp "$f.XXXXXX")
  cat "$f" > "$tmp"
  for range in $entries; do
    sed -i "${range%:*},${range#*:}s/^/# /" "$tmp"
  done
  if /usr/sbin/visudo -cf "$tmp" > /dev/null 2>&1; then
    cat "$tmp" > "$f"
    echo "Commented out !authenticate in $f"
  else
    echo "Fail to validate $f with visudo" >&2
  fi
  rm -f "$tmp"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```go
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-UBTU-22-432010
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_no_authenticate

- name: Comment out the sudoers entries that hold !authenticate
  ansible.builtin.shell:
    cmd: |
      set -o pipefail
      for f in /etc/sudoers /etc/sudoers.d/* ; do
        if [ ! -f "$f" ] ; then
          continue
        fi
        # The entries that hold "!authenticate", as first:last line numbers. A
        # trailing backslash continues an entry, and a comment ends at its line.
        entries=$(awk '{
            if (c) { t = t " " $0 } else { s = NR; t = $0; k = /^[[:space:]]*#/ }
            c = !k && /\\$/
            if (c) { sub(/\\$/, "", t) } else { print s ":" NR ":" t }
          } END { if (c) print s ":" NR ":" t }' "$f" |
          grep -P '^\d+:\d+:(?!#).*[\s,=):]\!authenticate' | cut -d: -f1,2)
        if [ -z "$entries" ] ; then
          continue
        fi
        # The copy sits beside the file, so visudo resolves relative includes.
        tmp=$(mktemp "$f.XXXXXX")
        cat "$f" > "$tmp"
        for range in $entries; do
          sed -i "${range%:*},${range#*:}s/^/# /" "$tmp"
        done
        if /usr/sbin/visudo -cf "$tmp" > /dev/null 2>&1; then
          cat "$tmp" > "$f"
          echo "Commented out !authenticate in $f"
        else
          echo "Fail to validate $f with visudo" >&2
        fi
        rm -f "$tmp"
      done
    executable: /bin/bash
  register: result_sudo_remove_config
  changed_when: result_sudo_remove_config.stdout != ""
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - DISA-STIG-UBTU-22-432010
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_no_authenticate
```