PingOne Privilege

Configuring step-up authentication for sudo commands

Step-up authentication adds a multi-factor authentication (MFA) challenge when a user runs the sudo command on a Unix/Linux server accessed through PingOne Privilege. The challenge is presented directly in the user’s terminal session.

Without step-up authentication, users with just-in-time (JIT) access can execute allowed sudo commands after signing on without any additional verification. If a user’s session is compromised, an attacker can escalate privileges unchecked. Step-up authentication confirms the human presence of the user at the moment of privilege escalation.

Consider requiring step-up authentication when your organization must comply with regulatory frameworks such as PCI, HIPAA, or SOX, which call for additional verification for privileged command execution.

How step-up authentication works

  1. A user with JIT access opens a session on a Unix/Linux server.

  2. The user runs a sudo command.

  3. If a step-up authentication policy applies, PingOne Privilege triggers an MFA challenge in the terminal session.

  4. The user completes the challenge using an approved MFA method.

  5. If the challenge succeeds, the sudo command proceeds. If it fails or times out, PingOne Privilege denies the command.

PingOne Privilege logs every step-up challenge and response for audit and compliance purposes. You can review these events in the session and activity logs. Learn more in Managing session logs and Managing activity logs.

MFA methods supported

Step-up authentication supports the MFA methods configured in your PingOne environment, including:

  • PingID mobile app (push notification or one-time passcode (OTP))

  • PingID desktop app

  • Other MFA methods supported by PingOne, such as biometric or device-bound passwordless authentication

To challenge users when they connect the PingOne Privilege app, learn more in Requiring PingID MFA for PingOne Privilege app connections.

Configuring a step-up authentication policy

Configure step-up authentication policies in the PingOne admin console. A policy defines when a sudo command requires an MFA challenge, such as every sudo attempt, specific commands, or time-based conditions.

Before you begin

  • Users have JIT access to Unix/Linux servers through PingOne Privilege. Learn more in Managing policies.

  • MFA is configured for your PingOne environment.

Steps

To require step-up authentication for sudo commands:

  1. In the PingOne admin console, go to the MFA policy settings for PingOne Privilege.

  2. Create or edit a policy that targets the Unix/Linux servers in scope.

  3. Select the option to require step-up authentication for privileged commands, and choose when the challenge applies.

  4. Save the policy.

The policy takes effect for new sudo commands in active sessions. Users already running an interactive session aren’t challenged until their next sudo attempt.

Step-up authentication and JIT access

Step-up authentication works with your existing JIT access policies. A user must still hold valid JIT access to the server before they can open a session. Step-up authentication adds verification at the moment of privilege escalation, not at session start.

If you use both JIT access policies and step-up authentication, users experience the following:

  1. The user requests access through the self-service portal, or a policy grants the user access.

  2. The user connects to the server using passwordless access.

  3. The user runs sudo, which triggers the MFA challenge defined by the step-up authentication policy.