“ALL ALL=(ALL) NOPASSWD:ALL” was auto added in my /etc/sudoers file. Is this a Security Breach?

Question

ALL ALL=(ALL) NOPASSWD:ALL line was auto added twice at the end of my /etc/sudoers file.

• My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the issue.
• Even after running sudo -k to reset the grace time it would not ask for my password.
• I figured out the meaning of that line and commented out the 2 lines to fix the issue and things were back to normal.

  But as per my searches the sudoers file is only edited manually and no way I could have given ALL users NOPASSWD permissions to ALL commands. Could this mean that a script I executed changed the sudoers file? Is this a cause of concern?

OS : Linux Mint 18.3 Cinnamon

Answer 1

After running this command

sudo grep -rl 'NOPASSWD:ALL' /etc /lib /usr /var /home /root

you advised that several files matched:

/etc/sudoers
/usr/lib/snapd/snapd
/var/log/auth.log
/home/neon/HUAWEI-4g_Dongle/Linux/install

The first three of these files could be reasonably expected to contain a match, and can be safely ignored. The fourth, on the other hand, appears to be a possible culprit and bears further investigation.

Indeed, your pastebin shows these snippets:

SOFTWARENAME="Mobile Partner"
SOFTWARENAME=$(echo $SOFTWARENAME | sed s\#\ \#_\#g)
TEMPFILE="${SOFTWARENAME}_install_$PPID"
... 

grep -v "MobilePartner.sh" /etc/sudoers >/tmp/${TEMPFILE} 2>&1
echo -e "ALL ALL=(ALL) NOPASSWD:ALL" >> /tmp/${TEMPFILE}
...

cp -f /tmp/${TEMPFILE} /etc/sudoers

Yes, I would say that's a (terrible) security hole from fairly lousy quality code.

Having removed (or commented out) the lines from your /etc/sudoers file, I would also recommend you check the permissions on that file. They should be ug=r,o= (0440 = r--r-----), probably owned by root:root.