Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
Requires sudo to run every command in a dedicated pseudo-terminal (Defaults use_pty), preventing terminal-hijacking after a privileged program exits.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Enabling Defaults use_pty forces every sudo command to run inside a pseudo-terminal allocated by sudo itself. Without it, a malicious program launched through sudo can use the TIOCSTI ioctl to inject characters back into the controlling terminal, allowing it to run further commands as the privileged user after the original program has finished. Requiring a dedicated PTY prevents this terminal-hijacking technique and ensures session output can be captured reliably.
What Pavois checks
Pavois checks the effective sudo policy by grepping /etc/sudoers and every drop-in under /etc/sudoers.d/ for an active Defaults ... use_pty line. Since sudo merges its main file with all @includedir drop-ins, scanning the entire set reflects the policy sudo actually enforces at runtime, a single-file check would miss a directive placed in a drop-in.
describe command('grep -rqE \'^[^#]*Defaults[^#]*\buse_pty\b\' /etc/sudoers /etc/sudoers.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run sudo grep -rE '^[^#]*Defaults[^#]*\buse_pty\b' /etc/sudoers /etc/sudoers.d/, it should return a line Defaults use_pty. Validate the drop-in syntax with sudo visudo -cf /etc/sudoers.d/99-Pavois-use_pty (expected: parsed OK).
Inspect & investigate
sudo invocations are recorded in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL); query them with journalctl _COMM=sudo. With use_pty active, sudo allocates a PTY for each session, which you can observe in process listings (ps -t) during a privileged command.
Remediation
Pavois's harden plan writes a drop-in file /etc/sudoers.d/99-Pavois-use_pty (owner root:root, mode 0440) containing Defaults use_pty, and validates it with visudo -cf before activating it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Defaults use_pty |
|---|---|
| group | root |
| mode | 0440 |
| owner | root |
| path | /etc/sudoers.d/99-pavois-use_pty |
| resource | file |
| verify | visudo -cf %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk for interactive use. The main caveat is automation: programs that run sudo without an attached terminal (some CI jobs, cron tasks, or remote ssh host sudo cmd calls without -t) may fail with sudo: a terminal is required to read the password or sudo: no tty present. Audit non-interactive sudo callers before enforcing, and use ssh -t or NOPASSWD rules where appropriate. The drop-in is validated with visudo -cf before activation to avoid a sudoers syntax error locking out privilege escalation.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R39 | direct | 2.0 | high |
| CIS | 2.2.6, 5.2.2 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.