--- title: "P15: Access Control: Accounts, Sudo and Logins" canonical: https://openvapt.com/academy/p15.html html: https://openvapt.com/academy/p15.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P15: Access Control: Accounts, Sudo and Logins Who may log in, from where, and what they may do once inside: the account, PAM, sudo and SSH settings that enforce it, and the files that define it. - Level: Practitioner - Time: about 25 minutes - Read first: P2, P7 ## You Will Be Able To - Tell authentication and authorisation apart and explain why both are needed. - Identify login paths that bypass access control: empty passwords, service accounts with shells, direct root login. - Explain what sudo rules, lockout and SSH authentication settings each enforce. - Explain why the permissions on account files and the default umask are access control too. ## What Access Control Means Access control answers one question: may this subject do this action on this object? The subject is a user or a program. The object is a file, a service or a command. Authentication proves who the subject is. Authorisation decides what that subject may do. A strong password with a NOPASSWD sudo rule behind it is good authentication and no authorisation. Two habits make access control work. Least privilege gives each account only what its job needs. Default deny refuses anything that is not explicitly allowed. NIST SP 800-53 groups these controls in the Access Control (AC) and Identification and Authentication (IA) families. CIS Controls v8 covers them in Controls 5 and 6. ## Who May Log In Every account that can log in is a door. Service accounts such as www-data or postgres should have a nologin shell, because nothing should ever log in as them. An account with an empty password field is a door with no lock. OpenVAPT treats it as Critical, and so should you. SSH must also refuse empty passwords. Root should not log in over SSH at all. Named users log in and then use sudo. That keeps a record of which person acted. Lockout limits guessing. PAM faillock locks an account for a while after a few failed attempts. SSH adds MaxAuthTries and a short LoginGraceTime. Password logins over SSH should be the exception. Where they remain, AuthenticationMethods can require a key as well, so a stolen password alone is not enough. ## What They May Do: Sudo Sudo is where authorisation is written down. Each rule says which user may run which commands as which target user. NOPASSWD removes the second proof. Any process running as that user, including a hijacked web application, becomes root with one command. Sudo should run commands in a pseudo-terminal and log to its own file. Then privileged actions are recorded and cannot linger after the session ends. Separation of duties means the person who approves a change is not the only person who can make it. On a small server, sudo logs are often the only evidence of who did what. ## The Files That Define Access Access control is only as strong as the files that store it. /etc/passwd and /etc/group must not be writable by others, or anyone can add a root account. /etc/shadow and /etc/gshadow hold password hashes and must not be readable by others. A readable shadow file turns every local user into an offline password cracker. Duplicate user ids give two names the same rights. Legacy '+' NIS entries can import accounts from elsewhere. Trust files such as .rhosts and .netrc grant access or hold passwords in plain text. The default umask decides who can read every new file. With 022 every new file is readable by every local user. 027 or stricter keeps new files private by default. ## In Summary Authentication proves identity and authorisation grants rights. Close every login path that is not needed. Keep sudo rules specific, with a password and a log. Protect the files that store accounts and passwords, and set a strict umask. ## Apply It - [HOST-FS-001 Sensitive Account Files Have Unsafe Permissions](https://openvapt.com/checks/HOST-FS-001.md) (high) - [HOST-FS-009 Default File Creation Mask Too Permissive](https://openvapt.com/checks/HOST-FS-009.md) (low) - [HOST-PWD-001 Weak Password Hashing Algorithm Configured](https://openvapt.com/checks/HOST-PWD-001.md) (medium) - [HOST-PWD-002 Accounts With Obsolete Password Hashes](https://openvapt.com/checks/HOST-PWD-002.md) (medium) - [HOST-PWD-003 Short Minimum Password Length](https://openvapt.com/checks/HOST-PWD-003.md) (low) - [HOST-PWD-004 No Account Lockout After Failed Logins](https://openvapt.com/checks/HOST-PWD-004.md) (medium) - [HOST-PWD-005 Forced Periodic Password Rotation Configured](https://openvapt.com/checks/HOST-PWD-005.md) (info) - [HOST-SSH-001 SSH Allows Direct Root Login](https://openvapt.com/checks/HOST-SSH-001.md) (high) - [HOST-SSH-002 SSH Password Authentication Enabled](https://openvapt.com/checks/HOST-SSH-002.md) (medium) - [HOST-SSH-003 SSH Permits Empty Passwords](https://openvapt.com/checks/HOST-SSH-003.md) (critical) - [HOST-SSH-006 SSH Allows Many Authentication Attempts](https://openvapt.com/checks/HOST-SSH-006.md) (low) - [HOST-SSH-008 SSH Authentication Controls Too Permissive](https://openvapt.com/checks/HOST-SSH-008.md) (low) - [HOST-SUDO-001 Sudo Commands Not Logged to a Dedicated File](https://openvapt.com/checks/HOST-SUDO-001.md) (low) - [HOST-USR-001 Extra Accounts With Root Privileges (UID 0)](https://openvapt.com/checks/HOST-USR-001.md) (high) - [HOST-USR-002 Accounts Without a Password](https://openvapt.com/checks/HOST-USR-002.md) (high) - [HOST-USR-003 Sudo Rules Without Password (NOPASSWD)](https://openvapt.com/checks/HOST-USR-003.md) (high) - [HOST-USR-004 Duplicate User IDs](https://openvapt.com/checks/HOST-USR-004.md) (medium) - [HOST-USR-005 System Accounts With Login Shells](https://openvapt.com/checks/HOST-USR-005.md) (low) - [HOST-USR-006 Legacy NIS Entries in Account Files](https://openvapt.com/checks/HOST-USR-006.md) (medium) - [HOST-USR-007 Insecure Trust Files in Home Directories](https://openvapt.com/checks/HOST-USR-007.md) (high) - [HOST-USR-008 Duplicate Group IDs or Account Names](https://openvapt.com/checks/HOST-USR-008.md) (medium) - [HOST-USR-009 Password and Shadow Files Out of Step](https://openvapt.com/checks/HOST-USR-009.md) (medium) - [HOST-USR-010 Home Directories Accessible to Other Users](https://openvapt.com/checks/HOST-USR-010.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-SSH-001,HOST-SSH-003,HOST-FS-001 --out p15` 2. `For each failed check, write one line: who gets in, or what they can do, that they should not.` 3. `Run: openvapt explain HOST-PWD-004 and read how pam_faillock is detected in both PAM positions.` 4. `On your own machine: awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd and ask why each listed account needs a shell.` 5. `On your own machine: sudo -l and read your own sudo rules. Which ones carry NOPASSWD, and why?` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. A user logs in with a strong password and runs a command through a NOPASSWD sudo rule. What is weak here? - A. Authentication - B. Authorisation - C. Encryption - D. Logging - Answer: B. The login proved identity well. The rule grants root with no second proof, so authorisation is weak. 2. Why should service accounts such as www-data have a nologin shell? - A. It makes the service start faster - B. Nothing should ever log in as them, so the door is closed - C. It hides the account from /etc/passwd - D. It stops the service writing logs - Answer: B. A login shell on a service account is a door that nothing legitimate uses. 3. What does PAM faillock enforce? - A. A minimum password length - B. A temporary lock after repeated failed logins - C. Key-based SSH authentication - D. A dedicated sudo log file - Answer: B. faillock counts failures and locks the account for a while, which slows guessing. 4. Why is a world-readable /etc/shadow a High finding even though nobody can write to it? - A. It lets any local user copy the hashes and crack them offline - B. It stops users changing their passwords - C. It makes logins slower - D. It disables sudo - Answer: A. Reading the hashes is enough; cracking happens elsewhere, at leisure. 5. What does a default umask of 022 mean for a report an administrator saves? - A. Only root can read it - B. Every local user can read it - C. It is encrypted at rest - D. It is deleted on reboot - Answer: B. 022 leaves the read bit for others set, so every new file is readable by every local account. ## Key Terms - Authentication: Proving who a user or program is, for example with a password, a key or a one-time code. - Authorisation: Deciding what an authenticated user or program may do, such as which files it may read or which commands it may run. - Least Privilege: Giving every account and process only the access it needs, nothing more. - Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed. - Account Lockout: Temporarily blocking an account after repeated failed logins to stop password guessing. - Separation of Duties: Splitting a sensitive task between people or roles so that no single account can both make and approve a change unseen. - Login Shell: The program started when an account logs in; a nologin or false shell means the account cannot be used interactively. - PAM: Pluggable Authentication Modules: the Linux framework through which programs check passwords and apply rules such as lockout, quality and history, configured in /etc/pam.d. - umask: The default permission mask applied to every new file and directory; a stricter mask keeps new files private. ## References - [NIST SP 800-53 Rev. 5, Security and Privacy Controls (AC and IA families)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) - [sudoers(5) manual](https://www.sudo.ws/docs/man/sudoers.man/) - [pam_faillock(8) manual](https://man7.org/linux/man-pages/man8/pam_faillock.8.html) Offline: `openvapt learn P15`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p15.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.