diff options
| author | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:45:32 +0200 |
|---|---|---|
| committer | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 12:45:32 +0200 |
| commit | 2474523199cde6d1ad8ef6ca085bd690bc5d619a (patch) | |
| tree | 1b79ef0f41e8960cee0cd42f0327c2efb4dfc1f7 /etc/sudoers.d | |
| parent | f37a43fab076b7f061f8a8ba55b80690904c7b6b (diff) | |
| download | postinstall-2474523199cde6d1ad8ef6ca085bd690bc5d619a.tar.gz postinstall-2474523199cde6d1ad8ef6ca085bd690bc5d619a.tar.bz2 postinstall-2474523199cde6d1ad8ef6ca085bd690bc5d619a.zip | |
harden sudo
Diffstat (limited to 'etc/sudoers.d')
| -rw-r--r-- | etc/sudoers.d/00-hardening | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/etc/sudoers.d/00-hardening b/etc/sudoers.d/00-hardening new file mode 100644 index 0000000..e1b1d08 --- /dev/null +++ b/etc/sudoers.d/00-hardening @@ -0,0 +1,11 @@ +# Force sudo to run in its own pseudo-terminal (prevents TTY hijacking) +Defaults use_pty + +# Reset environment variables on sudo execution +Defaults env_reset + +# Reduce the cached password window to 5 minutes (default is 15) +Defaults timestamp_timeout=5 + +# Clear screen after entering password +Defaults lecture=never |