--- title: "P20: Secrets, Cron and Account Hygiene" canonical: https://openvapt.com/academy/p20.html html: https://openvapt.com/academy/p20.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P20: Secrets, Cron and Account Hygiene The small cross-cutting habits that stop a low-privilege foothold becoming root. No secrets in readable files, restricted SSH keys, cron that runs only root-owned code, a clean PATH and consistent account files. - Level: Practitioner - Time: about 20 minutes - Read first: P7, P15 ## You Will Be Able To - Find secrets that any local user can read and explain why that is a lateral movement path. - Trace what a root cron job really executes and who could change it. - Spot account-file inconsistencies that tools such as pwck report. ## Secret Sprawl Secrets drift into configuration files, backups and .env files, and the file mode decides who else can use them. A password in a world-readable file under /etc or a web root is available to every website, service account and compromised process on the machine. OpenVAPT reads world-readable configuration-like files, within a fixed budget, for private key headers, cloud access key ids and password or token assignments. It reports only the file and the kind of match (HOST-SEC-001). The fix is two-fold: restrict the mode, and rotate the secret, because readable means leaked. ## Keys and Options A key in root's authorized_keys is a root password without an expiry date. OpenSSH lets each key carry options: from= limits the source addresses, command= pins the key to one program, and restrict turns off forwarding and PTYs. A root key with none of them, or an authorized_keys file others can write, is a quiet standing risk (HOST-SSH-013). ## What Root Runs on Schedule HOST-FS-005 protects the cron tables; the next question is what they run. A root job that executes /usr/local/bin/backup.sh is only as trustworthy as that file and its folder. If any user can edit or replace it, their code runs as root at the next run (HOST-CRON-001). Jobs that call a bare command name depend on PATH. A world-writable folder or a relative entry in cron's PATH lets anyone plant a program that root runs (HOST-CRON-002, MITRE ATT&CK T1574.007). ## Consistent Account Files /etc/passwd, /etc/shadow and /etc/group are three files that must agree. Two groups sharing a GID are one group to the kernel (HOST-USR-008). An account in passwd with no shadow line, a hash left in passwd, or a shadow line for a deleted user are signs of hand edits. They can also mean an interrupted removal (HOST-USR-009). pwck and grpck report the same. Home directories complete the picture: with others allowed in, any account can read another user's shell history and SSH keys or plant a .bashrc (HOST-USR-010). ## In Summary Secrets leak through readable files, keys without options, cron jobs that run writable programs and account files that disagree. Walk the configuration tree with bounds, restrict authorized_keys with from= and command=, keep cron programs and PATH root-owned, and reconcile passwd, shadow and group. ## Apply It - [HOST-CRON-001 Cron Jobs Run Programs Other Users Can Modify](https://openvapt.com/checks/HOST-CRON-001.md) (high) - [HOST-CRON-002 World-Writable Directory in Cron's PATH](https://openvapt.com/checks/HOST-CRON-002.md) (high) - [HOST-SEC-001 Secrets in World-Readable Files](https://openvapt.com/checks/HOST-SEC-001.md) (high) - [HOST-SSH-013 SSH Authorized Keys Without Restrictions or Protection](https://openvapt.com/checks/HOST-SSH-013.md) (low) - [HOST-USR-008 Duplicate Group IDs or Account Names](https://openvapt.com/checks/HOST-USR-008.md) (medium) - [HOST-USR-009 Password and Shadow Files Out of Step](https://openvapt.com/checks/HOST-USR-009.md) (medium) - [HOST-USR-010 Home Directories Accessible to Other Users](https://openvapt.com/checks/HOST-USR-010.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-SEC-,HOST-CRON-,HOST-SSH-013,HOST-USR-008,HOST-USR-009,HOST-USR-010 --out p15 and, for each finding, write who gains what.` 2. `In internal/lab/fixtures_containers_apps.go, follow the vulnerable /etc/crontab from PATH to the backup script and list every file a non-root user could change to run code as root.` 3. `On a test machine you are allowed to assess: pwck -r ; grpck -r ; find /etc -type f -perm -0004 -name '*.conf' | head and compare with the report.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. A root cron job runs backup-db with no path. Where is the risk? - A. Cron refuses to run it - B. Whichever folder on cron's PATH is writable by others can supply a fake backup-db - C. Only in /etc/crontab's permissions - D. Nowhere, because root jobs are always trusted - Answer: B. PATH interception: the first matching file on PATH runs as root. 2. What does from="203.0.113.0/24" in authorized_keys do? - A. Sets the key's expiry date - B. Limits the addresses the key may log in from - C. Encrypts the key - D. Forces the key to run one fixed command - Answer: B. from= restricts source addresses; command= and restrict limit what the key can do. 3. An account appears in /etc/passwd with x but has no /etc/shadow line. Why does it matter? - A. It cannot own files - B. Its password state is undefined and differs between tools; the files were edited inconsistently - C. It is automatically root - D. It is deleted at the next reboot - Answer: B. pwck reports this; pwconv or vipw repairs it. 4. What does HOST-SEC-001 report when it finds a secret in a world-readable file? - A. Only the file and the kind of match - B. The full secret value - C. Nothing, because it deletes the file - D. The file owner's password - Answer: A. Reports never copy the secret itself. The file and the kind of match are enough to act on. 5. A root cron job runs /usr/local/bin/backup.sh, and any user can edit that file. What follows? - A. Their code runs as root at the next run - B. Cron refuses to run the job - C. Only the file's owner is affected - D. Nothing, because cron checks a signature - Answer: A. A root job is only as trustworthy as the file it runs and the folder it sits in. ## Key Terms - Secret Sprawl: Secrets copied into configuration files, backups, scripts and environment files where more people and processes can read them than intended. - Authorized Keys Options: Prefixes in an SSH authorized_keys line, such as from=, command= and restrict, that limit where a key may log in from and what it may do. - PATH Interception: Planting a program in a folder that appears early in PATH, or in a writable PATH folder, so a privileged job runs it instead of the intended command. - Shadow File: /etc/shadow, the root-only file that holds password hashes and ageing data for the accounts listed in /etc/passwd. - Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root. ## References - [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) - [sshd(8), AUTHORIZED_KEYS FILE FORMAT](https://man.openbsd.org/sshd.8#AUTHORIZED_KEYS_FILE_FORMAT) - [MITRE ATT&CK T1574.007, Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007/) - [MITRE ATT&CK T1053.003, Cron](https://attack.mitre.org/techniques/T1053/003/) - [pwck(8), Linux man-pages](https://man7.org/linux/man-pages/man8/pwck.8.html) - [NIST SP 800-53 Rev. 5, IA-5 Authenticator Management](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) Offline: `openvapt learn P20`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p20.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.