From 2474523199cde6d1ad8ef6ca085bd690bc5d619a Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 12:45:32 +0200
Subject: harden sudo

---
 etc/sudoers.d/00-hardening | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 etc/sudoers.d/00-hardening

(limited to 'etc/sudoers.d')

diff --git a/etc/sudoers.d/00-hardening b/etc/sudoers.d/00-hardening
new file mode 100644
index 0000000..e1b1d08
--- /dev/null
+++ b/etc/sudoers.d/00-hardening
@@ -0,0 +1,11 @@
+# Force sudo to run in its own pseudo-terminal (prevents TTY hijacking)
+Defaults use_pty
+
+# Reset environment variables on sudo execution
+Defaults env_reset
+
+# Reduce the cached password window to 5 minutes (default is 15)
+Defaults timestamp_timeout=5
+
+# Clear screen after entering password
+Defaults lecture=never
-- 
cgit