Can someone please have a look at my modified sudoers file?

Question

Level 1

8 points

Can someone please have a look at my modified sudoers file?

Hi,

I just ran EtreCheck to see if there were any issues with my computer and it flagged that my sudoers file has been modified. Based on the report below, is this something I should be concerned about?

Thank you for taking a look, I really appreciate it.

Here are the contents of my sudoers file:

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
# Failure to use 'visudo' may result in syntax or file permission errors
# that prevent sudo from running.
#
# See the sudoers man page for the details on how to write a sudoers file.
#


# Host alias specification


# User alias specification


# Cmnd alias specification


# Defaults specification
Defaults env_reset
Defaults env_keep += "BLOCKSIZE"
Defaults env_keep += "COLORFGBG COLORTERM"
Defaults env_keep += "__CF_USER_TEXT_ENCODING"
Defaults env_keep += "CHARSET LANG LANGUAGE LC_ALL LC_COLLATE LC_CTYPE"
Defaults env_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME"
Defaults env_keep += "LINES COLUMNS"
Defaults env_keep += "LSCOLORS"
Defaults env_keep += "SSH_AUTH_SOCK"
Defaults env_keep += "TZ"
Defaults env_keep += "DISPLAY XAUTHORIZATION XAUTHORITY"
Defaults env_keep += "EDITOR VISUAL"
Defaults env_keep += "HOME MAIL"


# Runas alias specification


# User privilege specification
root ALL=(ALL) ALL
%admin ALL=(ALL) ALL


# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL


# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL


# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now
#includedir /etc/sudoers.d

And here is the EtreCheck report:

EtreCheck version: 4.1.3 (4A188)

Report generated: 2018-03-21 13:11:22

Download EtreCheck from https://etrecheck.com

Runtime: 2:36

Performance: Excellent

Problem: No problem - just checking

Major Issues:

Anything that appears on this list needs immediate attention.

Modified suoders file - The sudoers file has been modified. This is unusual and is sometimes evidence of malware.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Heavy RAM usage - This machine is using a large amount of RAM.

Unsigned files - There is unsigned software installed. They appear to be legitimate but should be reviewed.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

iMac (Retina 5K, 27-inch, Late 2014)

iMac Model: iMac15,1

1 3.5 GHz Intel Core i5 (i5-4690) CPU: 4-core

32 GB RAM At maximum

BANK 0/DIMM0

8 GB DDR3 1600 ok

BANK 1/DIMM0

8 GB DDR3 1600 ok

BANK 0/DIMM1

8 GB DDR3 1600 ok

BANK 1/DIMM1

8 GB DDR3 1600 ok

Video Information:

AMD Radeon R9 M295X - VRAM: 4 GB

iMac 5120 x 2880

LED Cinema Display 2560 x 1440

Drives:

disk0 - APPLE SSD SD0128F 121.33 GB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x2 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [Core Storage Container] 120.99 GB

disk2 - Macintosh HD (Journaled HFS+) [Fusion Drive] 3.11 TB

disk0s3 - B*******X [Recovery] 134 MB

disk1 - APPLE HDD ST3000DM001 3.00 TB (Mechanical)

Internal SATA 6 Gigabit Serial ATA

disk1s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk1s2 [Core Storage Container] 3.00 TB

disk2 - Macintosh HD (Journaled HFS+) [Fusion Drive] 3.11 TB

disk1s3 - Recovery HD [Recovery] 650 MB

Mounted Volumes:

disk2 - Macintosh HD [Fusion Drive] 3.11 TB (1.12 TB free)

Journaled HFS+

Mount point: /

Network:

Interface usbmodem1440: MT65xx Preloader 5

Interface usbmodem14410: MT65xx Preloader 4

Interface usbmodem1420: MT65xx Preloader 3

Interface usbmodem1430: MT65xx Preloader 2

Interface usbmodem1410: MT65xx Preloader

Interface Bluetooth-Modem: Bluetooth DUN

Interface en0: Ethernet

One IPv4 address

Interface en6: iPad

Interface en1: Wi-Fi

Interface en5: iPhone

Interface en4: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 123.30 GB available

System Software:

macOS High Sierra 10.13.3 (17D102)

Time since boot: Less than an hour

System Load: 1.86 (1 min ago) 2.39 (5 min ago) 2.34 (15 min ago)

Configuration Files:

File /etc/sudoers size: Found 1302 but expected 1563

Security:

System	Status
Gatekeeper	Mac App Store and identified developers
System Integrity Protection	Enabled

Unsigned Files:

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/JavaUpdater.app/Contents/Ma cOS/JavaUpdater -bgcheck