For Teachers · Back to the Module · Print with your browser's Print command.

P7 Teacher Answer Key: Identity, Passwords and Privilege

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain why password hashing algorithms and lengths matter.
• [ ] Recognise privilege escalation paths: UID 0 accounts, NOPASSWD sudo and the docker group.
• [ ] Explain why legacy trust files and service account shells are risky.

Key Terms

Write each definition in your own words.

• Least Privilege: Giving every account and process only the access it needs, nothing more.
• Brute Force: Trying many passwords or keys in turn until one works.
• Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root.
• Password Hashing: Storing a one-way, salted, deliberately slow transformation of a password instead of the password itself.
• Account Lockout: Temporarily blocking an account after repeated failed logins to stop password guessing.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-DKR- --out p7
2. For each finding, explain how an attacker would turn it into root access.
3. On your own machine: getent group docker sudo wheel and review who is listed.

Self-Check Questions

1. Why is yescrypt or SHA-512 crypt preferred over MD5-crypt?

• [x] a) They are salted and deliberately slow to crack
• [ ] b) They make passwords shorter
• [ ] c) They encrypt the whole disk
• [ ] d) They need no salt
• Answer: a. Slow, salted hashing makes offline cracking of a stolen shadow file expensive.

1. Why is membership of the docker group dangerous?

• [ ] a) It slows the server
• [x] b) It allows starting containers that mount the host filesystem, which is root access
• [ ] c) It disables SSH
• [ ] d) It gives read-only access to container logs
• Answer: b. Control of Docker is equivalent to root on the host.

1. What does an account lockout policy defend against?

• [x] a) Password guessing
• [ ] b) Disk failure
• [ ] c) TLS downgrade
• [ ] d) Session theft through XSS
• Answer: a. Lockout limits repeated guesses against an account.

1. What does NIST SP 800-63B-4 favour for passwords?

• [ ] a) Composition rules such as one symbol and one digit
• [x] b) Length, and blocking known-breached passwords
• [ ] c) Changing every password every 30 days
• [ ] d) Exactly 8 characters
• Answer: b. NIST favours length over complexity rules and asks verifiers to block passwords known to be breached.

1. Why are .rhosts files risky?

• [ ] a) They store password hashes
• [x] b) They trust whole machines instead of people
• [ ] c) They make SSH slower
• [ ] d) They disable sudo logging
• Answer: b. Legacy trust files let anyone on a trusted machine in, without proving who they are.

1. The system now uses yescrypt. Why can old MD5-crypt hashes still be in /etc/shadow?

• [ ] a) yescrypt cannot read them
• [x] b) A hash changes only when the user next changes their password
• [ ] c) MD5 hashes can never be removed
• [ ] d) /etc/shadow is read-only
• Answer: b. Old hashes stay until each user changes their password, so a policy change needs follow-up.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• MITRE ATT&CK T1548, Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.