Securing sudo

$ sudo visudo # sudoers can only be opened with this command
$ o # to open a line

# Then add this under “Defaults” section:
# Require the root user to authenticate
Defaults:rootpw

# This writes sudo commands to 'secure.log' rather than 'system.log' which can be viewed by anyone who is an admin
Defaults:ALL !syslog
Defaults:ALL logfile=/var/log/secure.log

# Requires any sudo command to be authenticated every time
# Defaults:ALL timestamp_timeout=0

# Requires each individual TTY ticket to be authenticated
Defaults:ALL tty_tickets

$ <Esc> :w # to save the file
$ <Esc> :q # to quit