--- sudoers
+++ sudoers
@@ -13,6 +13,24 @@
 
 # Defaults specification
 
+# Prevent environment variables from influencing programs in an
+# unexpected or harmful way (CVE-2005-2959, CVE-2005-4158, CVE-2006-0151)
+Defaults always_set_home
+Defaults env_reset
+
+Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE"
+# Comment out the preceding line and uncomment the following one if you need
+# to use special input methods. This may allow users to compromise  the root
+# account if they are allowed to run commands without authentication.
+#Defaults env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
+
+# In the default (unconfigured) configuration, sudo asks for the root password.
+# This allows use of an ordinary user account for administration of a freshly
+# installed system. When configuring sudo, delete the two
+# following lines:
+Defaults targetpw   # ask for the password of the target user i.e. root
+ALL ALL=(ALL) ALL   # WARNING! Only use this together with 'Defaults targetpw'!
+
 # Runas alias specification
 
 # User privilege specification