Passwordless sudo rules
high on-server
What it inspects
Every non-comment line containing NOPASSWD in /etc/sudoers and /etc/sudoers.d/, read as root. A rule is wide-scope if it grants `NOPASSWD: ALL` or applies to the %sudo, %wheel, %admin or %root group. A wide rule for a local user is ignored if that account has no login shell or its password is locked (sudo is then only reachable with an SSH key). Group rules (%sudo, %wheel and so on) and users that are not in the local account data (for example directory users) always fail, and if account data cannot be read every wide rule fails. A wide rule for a local user with a usable password fails. Narrow rules alone produce a warning.
Why it matters
With NOPASSWD: ALL, anyone who gets a shell as that account, through a stolen key, an application bug or a guessed password, becomes root with no second step. Requiring the sudo password keeps a compromised unprivileged session from escalating silently. Command-specific grants for automation are a reasonable alternative.
How to verify
sudo grep -rEn '^[[:space:]]*[^#].*NOPASSWD' /etc/sudoers /etc/sudoers.d/How to fix
List the NOPASSWD rules, then for each decide whether to remove it, narrow it to specific commands, or leave it because the account has no usable password. Edit only with visudo.
Review each NOPASSWD rule and remove or narrow it needs your judgement
Any distro
# Which rules exist (file:line:rule):
# grep -rEn '^[[:space:]]*[^#].*NOPASSWD' /etc/sudoers /etc/sudoers.d/
# For each wide rule (`NOPASSWD: ALL`, or %sudo / %wheel / %admin) choose ONE:
# a) Remove it: sudo visudo -f /etc/sudoers.d/<file> (delete the line; visudo checks syntax on save)
# b) Narrow it to what automation really needs, for example:
# deploy ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx
# c) Keep it only for a local user whose password is locked OR which has no login shell.
# The check then ignores that rule (group rules such as %sudo are never ignored). Cloud images often ship /etc/sudoers.d/90-cloud-init-users with
# `<admin> ALL=(ALL) NOPASSWD:ALL` for the default key-only user; that is the usual case for (c).
# LOCKOUT WARNING: if you remove NOPASSWD for an account that has no password set (key-only login),
# sudo will start asking for a password that does not exist. Set one first with `passwd <user>`
# and test `sudo -v` from a second session before closing your current root shell.
# Rules that are already narrow (specific commands) keep the check at a warning by design;
# it passes when no NOPASSWD rules remain or all wide ones are for local users with a locked password or no login shell.