STIG: Fix a Dangerous sudo Policy

MediumLinux Security20-25 min

The brief

A drop-in under /etc/sudoers.d grants 'devuser' passwordless root — a classic audit finding. Bring the sudo policy to the DISA STIG baseline: devuser should keep sudo access but MUST re-authenticate (no NOPASSWD), sudo sessions must run in a pty, and sudo use must be logged. Grading reads the sudoers.d drop-ins the way an assessor would. Edit carefully — a broken sudoers file is itself a finding.

What you'll do

Remove passwordless sudo (no NOPASSWD in /etc/sudoers.d)
devuser retains sudo but must authenticate
sudo runs commands in a pty (Defaults use_pty)
sudo use is logged (Defaults logfile)

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.