For Teachers · Back to the Module · Print with your browser's Print command.

P22 Teacher Answer Key: Authentication Policy and Package Hygiene

Teacher Answer Key (about 35 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P7, P15

Learning Objectives

• [ ] Explain what pam_pwquality, pam_faillock, pam_pwhistory and pam_wheel each decide, and read their options from a PAM stack.
• [ ] Explain the login.defs and useradd defaults that govern password age and inactive accounts, and where current NIST guidance differs from older practice.
• [ ] Recognise an unsafe root PATH and explain the privilege escalation it allows.
• [ ] Explain why repository signatures, third-party repositories, retained kernels and legacy services are patch management problems.

Key Terms

Write each definition in your own words.

• PAM: Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d.
• Password History: Remembering a user's recent password hashes so that a changed password cannot be changed straight back to an old one.
• Path Interception: Getting a privileged user to run an attacker's program by placing it in a directory that appears on their PATH before the real command, for example through a . or empty PATH entry.
• Repository Signing: The digital signature over a package repository's index that apt and dnf verify before trusting any package in it; disabling the check lets a tampered mirror install code as root.
• Legacy Service: A network service such as Telnet, rsh, TFTP or NIS that predates modern encrypted alternatives and is rarely needed, but is still packaged and easy to leave installed.
• Idle Timeout: Closing an interactive session automatically after a period without input (TMOUT in the shell), so an unattended logged-in terminal does not stay open.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-PAM- --out p22a and read the common-password stacks in internal/lab/fixtures_audit_pam_pkg.go side by side.
2. Run: openvapt demo --only HOST-PKG- --out p22b and find the sources.list entry that fails HOST-PKG-002 and the one listed by HOST-PKG-003.
3. Run: openvapt demo --only HOST-SVC- --out p22c and, for each failed check, decide whether removing the package or disabling the unit would be the right fix on a real server.
4. On a test machine you own: sudo openvapt scan --only HOST-PAM-,HOST-PKG-,HOST-SVC- and compare with grep pam_ /etc/pam.d/common-password and dpkg -l | grep '^ii' .

Self-Check Questions

1. pwquality.conf sets minlen = 14, but /etc/pam.d/common-password has no pam_pwquality line. What is enforced?

• [ ] a) A 14-character minimum
• [x] b) Nothing from pwquality: the module is never called
• [ ] c) Only a dictionary check
• [ ] d) A 14-character minimum for root only
• Answer: b. PAM settings take effect only through the modules the stack actually calls.

1. Root's .bashrc sets PATH=.:/usr/bin:/bin. What can a local user do?

• [ ] a) Nothing: . is harmless
• [x] b) Place a program named ls in a directory root will visit and have it run as root
• [ ] c) Read root's files
• [ ] d) Change root's password
• Answer: b. A leading . (or empty element) runs programs from the current directory first.

1. A sources.list entry carries [trusted=yes]. What does apt skip for it?

• [ ] a) Downloading the package
• [x] b) Verifying the repository signature
• [ ] c) Installing dependencies
• [ ] d) Checking free disk space
• Answer: b. Without signature verification a tampered mirror or intercepted download installs as root.

1. telnetd is installed but systemctl says telnet.socket is inactive. Why do the HOST-SVC checks still report it?

• [ ] a) Because active and installed are the same thing
• [x] b) Because an installed service comes back with the next upgrade or reboot and is one command from running
• [ ] c) Because Telnet is encrypted
• [ ] d) Because the socket is always active anyway
• Answer: b. Installed-but-stopped is latent attack surface; remove what is not needed.

1. Why does an installed kernel update not protect the machine straight away?

• [x] a) The old kernel keeps running until the machine boots into the new one
• [ ] b) Kernels update themselves while running
• [ ] c) It needs a new licence first
• [ ] d) Updates are only downloaded, never installed
• Answer: a. A kernel update protects nothing until the machine boots into it (HOST-PKG-005).

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• NIST SP 800-53 Rev. 5, IA-5, AC-7 and CM-7: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: https://csrc.nist.gov/pubs/sp/800/40/r4/final
• NIST SP 800-123, Guide to General Server Security: https://csrc.nist.gov/pubs/sp/800/123/final
• pam.conf(5), Linux man-pages (PAM configuration): https://man7.org/linux/man-pages/man5/pam.conf.5.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.