For Teachers · Back to the Module · Print with your browser's Print command.

P15 Teacher Answer Key: Access Control: Accounts, Sudo and Logins

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P2, P7

Learning Objectives

• [ ] Tell authentication and authorisation apart and explain why both are needed.
• [ ] Identify login paths that bypass access control: empty passwords, service accounts with shells, direct root login.
• [ ] Explain what sudo rules, lockout and SSH authentication settings each enforce.
• [ ] Explain why the permissions on account files and the default umask are access control too.

Key Terms

Write each definition in your own words.

• Authentication: Proving who a user or program is, for example with a password, a key or a one-time code.
• Authorisation: Deciding what an authenticated user or program may do, such as which files it may read or which commands it may run.
• Least Privilege: Giving every account and process only the access it needs, nothing more.
• Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed.
• Account Lockout: Temporarily blocking an account after repeated failed logins to stop password guessing.
• Separation of Duties: Splitting a sensitive task between people or roles so that no single account can both make and approve a change unseen.
• Login Shell: The program started when an account logs in; a nologin or false shell means the account cannot be used interactively.
• PAM: Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d.
• umask: The default permission mask applied to every new file and directory; a stricter mask keeps new files private.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-SSH-001,HOST-SSH-003,HOST-FS-001 --out p15
2. For each failed check, write one line: who gets in, or what they can do, that they should not.
3. Run: openvapt explain HOST-PWD-004 and read how pam_faillock is detected in both PAM positions.
4. On your own machine: awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd and ask why each listed account needs a shell.
5. On your own machine: sudo -l and read your own sudo rules. Which ones carry NOPASSWD, and why?

Self-Check Questions

1. A user logs in with a strong password and runs a command through a NOPASSWD sudo rule. What is weak here?

• [ ] a) Authentication
• [x] b) Authorisation
• [ ] c) Encryption
• [ ] d) Logging
• Answer: b. The login proved identity well. The rule grants root with no second proof, so authorisation is weak.

1. Why should service accounts such as www-data have a nologin shell?

• [ ] a) It makes the service start faster
• [x] b) Nothing should ever log in as them, so the door is closed
• [ ] c) It hides the account from /etc/passwd
• [ ] d) It stops the service writing logs
• Answer: b. A login shell on a service account is a door that nothing legitimate uses.

1. What does PAM faillock enforce?

• [ ] a) A minimum password length
• [x] b) A temporary lock after repeated failed logins
• [ ] c) Key-based SSH authentication
• [ ] d) A dedicated sudo log file
• Answer: b. faillock counts failures and locks the account for a while, which slows guessing.

1. Why is a world-readable /etc/shadow a High finding even though nobody can write to it?

• [x] a) It lets any local user copy the hashes and crack them offline
• [ ] b) It stops users changing their passwords
• [ ] c) It makes logins slower
• [ ] d) It disables sudo
• Answer: a. Reading the hashes is enough; cracking happens elsewhere, at leisure.

1. What does a default umask of 022 mean for a report an administrator saves?

• [ ] a) Only root can read it
• [x] b) Every local user can read it
• [ ] c) It is encrypted at rest
• [ ] d) It is deleted on reboot
• Answer: b. 022 leaves the read bit for others set, so every new file is readable by every local account.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-53 Rev. 5, Security and Privacy Controls (AC and IA families): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• sudoers(5) manual: https://www.sudo.ws/docs/man/sudoers.man/
• pam_faillock(8) manual: https://man7.org/linux/man-pages/man8/pam_faillock.8.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.