Hi, I am translating some of our policy requirements in rootcheck checks but I am having problem with a very simple rule. I want to detect if sudo is configured to give access to users without asking for password. To do this I have put a custom rule in a file configured in a "<system_audit>" directive. The custom rule file is correctly merged in merged.mg and sent across to all the agents but the rule doesn't work. I am checking the word NOPASSWD in the file /etc/passwd on a line that doesn't start with a comment. To do so I use the following:
[TEST] [any] [https://test/test] f:/etc/sudoers -> !r:^# && r:NOPASSWD; Unfortunately this doesn't seem to work. Any thoughts? How I can troubleshoot this? Is there a way to put rootcheck in debug mode? Thank You, --MC
