OpenVAPTIdentity, Passwords and Privilege
How accounts, password storage, lockout and privilege escalation paths decide who really controls a server.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p7.html. Offline: openvapt learn P7.
Read First: P1
You Will Be Able To
- Explain why password hashing algorithms and lengths matter.
- Recognise privilege escalation paths: UID 0 accounts, NOPASSWD sudo and the docker group.
- Explain why legacy trust files and service account shells are risky.
Storing Passwords
Linux stores password hashes in /etc/shadow. Modern algorithms such as yescrypt and SHA-512 crypt are salted and deliberately slow, so a stolen shadow file is expensive to crack. MD5-crypt and DES are fast and obsolete. Old hashes stay until each user changes their password.
NIST SP 800-63B-4 favours length over complexity rules and asks for known-breached passwords to be blocked. It requires at least 15 characters when a password is the only factor, or 8 when it is used with another factor. It also requires limits on failed attempts. OpenVAPT flags a minimum below 15 characters and recommends a lockout after repeated failures. Together they make online guessing impractical.
Who Is Really Root
Root is not a name but user id 0. Extra UID 0 accounts, duplicate UIDs and NOPASSWD sudo rules all give root, often without a password. So does membership of the docker group, which can mount the host filesystem.
Sudo should run commands in a pseudo-terminal and log them to a dedicated file, so privileged actions are recorded and cannot linger.
Legacy Trust
.rhosts and .shosts files trust whole machines instead of people, and .netrc files hold plain-text passwords. Legacy '+' NIS entries can import unexpected accounts. Service accounts should never have a login shell.
In Summary
Root is UID 0, not a name. Slow, salted hashing protects a stolen password file. Lockout slows guessing. NOPASSWD sudo and the docker group are root without a password.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
| Check | Title | Severity |
|---|---|---|
HOST-DKR-001 | Users With Root-Equivalent Docker Access | High |
HOST-PWD-001 | Weak Password Hashing Algorithm Configured | Medium |
HOST-PWD-002 | Accounts With Obsolete Password Hashes | Medium |
HOST-PWD-003 | Short Minimum Password Length | Low |
HOST-PWD-004 | No Account Lockout After Failed Logins | Medium |
HOST-PWD-005 | Forced Periodic Password Rotation Configured | Info |
HOST-SUDO-001 | Sudo Commands Not Logged to a Dedicated File | Low |
HOST-USR-001 | Extra Accounts With Root Privileges (UID 0) | High |
HOST-USR-002 | Accounts Without a Password | High |
HOST-USR-003 | Sudo Rules Without Password (NOPASSWD) | High |
HOST-USR-004 | Duplicate User IDs | Medium |
HOST-USR-005 | System Accounts With Login Shells | Low |
HOST-USR-006 | Legacy NIS Entries in Account Files | Medium |
HOST-USR-007 | Insecure Trust Files in Home Directories | High |
HOST-USR-008 | Duplicate Group IDs or Account Names | Medium |
HOST-USR-009 | Password and Shadow Files Out of Step | Medium |
HOST-USR-010 | Home Directories Accessible to Other Users | Low |
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-DKR- --out p7For each finding, explain how an attacker would turn it into root access.On your own machine: getent group docker sudo wheel and review who is listed.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management
- MITRE ATT&CK T1548, Abuse Elevation Control Mechanism
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). P7: Identity, Passwords and Privilege (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p7.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_p7,
author = {{OpenVAPT}},
title = {{P7: Identity, Passwords and Privilege}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/p7.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.