# Cis Ubuntu2004 V300 5 2 1

> Ensure sudo is installed

- Skill: `cyberstrikeus/cis-ubuntu2004-v300-5-2-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ubuntu2004-v300-5-2-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ubuntu2004-v300-5-2-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ubuntu2004-v300-5-2-1

---


# Ensure sudo is installed (Automated)

## Profile Applicability

- Level 1 - Server
- Level 1 - Workstation

## Description

`sudo` allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. The invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy.

## Rationale

`sudo` supports a plug-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug-ins to work seamlessly with the `sudo` front end. The default security policy is `sudoers`, which is configured via the file `/etc/sudoers` and any entries in `/etc/sudoers.d`.

The security policy determines what privileges, if any, a user has to run `sudo`. The policy may require that users authenticate themselves with a password or another authentication mechanism. If authentication is required, `sudo` will exit if the user's password is not entered within a configurable time limit. This limit is policy-specific.

## Audit Procedure

### Command Line

Run the following command to verify that either `sudo` is installed:

```bash
# dpkg-query -s sudo &>/dev/null && echo "sudo is installed"
```

```
sudo is installed
```

- OR -
  Run the following command to verify that either `sudo-ldap` is installed:

```bash
# dpkg-query -s sudo-ldap &>/dev/null && echo "sudo-ldap is installed"
```

```
sudo-ldap is installed
```

## Expected Result

Either `sudo is installed` or `sudo-ldap is installed` should be returned.

## Remediation

### Command Line

First determine if LDAP functionality is required. If so, then install `sudo-ldap`, else install `sudo`.
Example:

```bash
# apt install sudo
```

## References

1. SUDO(8)
2. NIST SP 800-53 Rev. 5: AC-6

## CIS Controls

v8 - 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.

v7 - 4.3 Ensure the Use of Dedicated Administrative Accounts
Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.

MITRE ATT&CK Mappings: T1548 | TA0004 | M1026