Secrets, Cron and Account Hygiene

Secret Sprawl

Secrets drift into configuration files, backups and .env files, and the file mode decides who else can use them. A password in a world-readable file under /etc or a web root is available to every website, service account and compromised process on the machine. OpenVAPT reads world-readable configuration-like files, within a fixed budget, for private key headers, cloud access key ids and password or token assignments. It reports only the file and the kind of match (HOST-SEC-001). The fix is two-fold: restrict the mode, and rotate the secret, because readable means leaked.

Keys and Options

A key in root's authorized_keys is a root password without an expiry date. OpenSSH lets each key carry options: from= limits the source addresses, command= pins the key to one program, and restrict turns off forwarding and PTYs. A root key with none of them, or an authorized_keys file others can write, is a quiet standing risk (HOST-SSH-013).

What Root Runs on Schedule

HOST-FS-005 protects the cron tables; the next question is what they run. A root job that executes /usr/local/bin/backup.sh is only as trustworthy as that file and its folder. If any user can edit or replace it, their code runs as root at the next run (HOST-CRON-001). Jobs that call a bare command name depend on PATH. A world-writable folder or a relative entry in cron's PATH lets anyone plant a program that root runs (HOST-CRON-002, MITRE ATT&CK T1574.007).

Consistent Account Files

/etc/passwd, /etc/shadow and /etc/group are three files that must agree. Two groups sharing a GID are one group to the kernel (HOST-USR-008). An account in passwd with no shadow line, a hash left in passwd, or a shadow line for a deleted user are signs of hand edits. They can also mean an interrupted removal (HOST-USR-009). pwck and grpck report the same. Home directories complete the picture: with others allowed in, any account can read another user's shell history and SSH keys or plant a .bashrc (HOST-USR-010).

In Summary

Secrets leak through readable files, keys without options, cron jobs that run writable programs and account files that disagree. Walk the configuration tree with bounds, restrict authorized_keys with from= and command=, keep cron programs and PATH root-owned, and reconcile passwd, shadow and group.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-SEC-,HOST-CRON-,HOST-SSH-013,HOST-USR-008,HOST-USR-009,HOST-USR-010 --out p15 and, for each finding, write who gains what.
2. In internal/lab/fixtures_containers_apps.go, follow the vulnerable /etc/crontab from PATH to the backup script and list every file a non-root user could change to run code as root.
3. On a test machine you are allowed to assess: pwck -r ; grpck -r ; find /etc -type f -perm -0004 -name '*.conf' | head and compare with the report.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OWASP Secrets Management Cheat Sheet
• sshd(8), AUTHORIZED_KEYS FILE FORMAT
• MITRE ATT&CK T1574.007, Path Interception by PATH Environment Variable
• MITRE ATT&CK T1053.003, Cron
• pwck(8), Linux man-pages
• NIST SP 800-53 Rev. 5, IA-5 Authenticator Management

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P20: Secrets, Cron and Account Hygiene (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p20.html

@misc{openvapt_p20,
  author       = {{OpenVAPT}},
  title        = {{P20: Secrets, Cron and Account Hygiene}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p20.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}