HighOS hardeningBLWK-PRIV-001

A sudoers entry allows passwordless root

What this means

A NOPASSWD sudo rule in ‹source› (“‹line›”) lets that user/group run commands as root without re-authenticating — anyone who reaches that account, even briefly, has unrestricted root with no password prompt to slow them down.

How to fix it

Review the entry and remove NOPASSWD unless there's a specific, scoped reason for it (e.g. a single monitoring command, not ALL).

Check it yourself

Run a scan and look for BLWK-PRIV-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sudoers and reports this check when:

nopasswd == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1548.003

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001