Install sudo Package
Ensures the sudo package is installed, enabling per-user, logged privilege escalation instead of shared root access.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
sudo lets administrators grant limited, audited root privileges to users instead of sharing the root password. The basic philosophy is least privilege: give as few rights as possible while still letting users do their work, and log every privileged command for accountability. Without sudo, teams fall back on direct root logins or a shared root password, which destroys per-user attribution and is a classic audit failure.
What Pavois checks
Pavois reads the effective install state from the package database via CINC/InSpec's package resource and asserts sudo is present. The package must exist before any /etc/sudoers policy can take effect, so this package check is the foundation for every downstream sudo-hardening rule (use_pty, logfile, NOPASSWD restrictions).
describe package('sudo') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s sudo (Debian/Ubuntu) or rpm -q sudo (RHEL/Alma/Fedora); a compliant host returns the installed version. Confirm the binary works with sudo -V (prints the sudo version and plugin info).
Inspect & investigate
- Installation is logged in
/var/log/dpkg.logor/var/log/dnf.log. - sudo invocations (granted and denied) are recorded by syslog in
/var/log/auth.log(Debian/Ubuntu) or/var/log/secure(RHEL), and viajournalctl _COMM=sudo.
Remediation
The harden plan declares a package resource for sudo with action install; pavois harden apply installs it via the native package manager (apt/dnf). Installing it does not grant anyone privileges by itself, you still define rules in /etc/sudoers.d/.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | sudo |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing sudo is safe and non-disruptive. The real precaution is in policy: after installing, make sure at least one administrator is in the sudo/wheel group before you disable direct root login or root SSH, or you risk locking yourself out. Always validate sudoers edits with visudo -c to avoid a syntax error that breaks all escalation. No reboot required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R33 | direct | 2.0 | high |
| CIS | 2.2.6, 5.2.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.