Impact of enabling Require sudo use_pty on AutoSys Batch Jobs in Linux

Products

• Autosys Workload Automation

Issue/Introduction

To comply with "Center for Internet Security" (CIS) controls, Cybersecurity teams may want to enable a setting where the sudo command can only be utilized via a pseudo-terminal (PTY) session (e.g., a PuTTY session). There is a concern that enabling the "Require sudo use_pty" rule will break all batch jobs on Linux servers.

Environment

Product: AutoSys Workload Automation
Operating System: Linux/UNIX
Security Control: CIS "Require sudo use_pty"

Resolution

Enabling the "Require sudo use_pty" rule will not cause a problem for batch processing, unless you have command jobs that specifically make a call to sudo. Review your job definitions to ensure sudo is not being used in the command: field

The agent does not perform a sudo to process any jobs. 

On Linux/UNIX based system the agent should be configured to run as the root user, as root is the only account that can become another user. Agent becomes another user through setuid, not sudo.