--- title: "P7: Identity, Passwords and Privilege" canonical: https://openvapt.com/academy/p7.html html: https://openvapt.com/academy/p7.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P7: Identity, Passwords and Privilege How accounts, password storage, lockout and privilege escalation paths decide who really controls a server. - Level: Practitioner - Time: about 25 minutes - Read first: P1 ## You Will Be Able To - Explain why password hashing algorithms and lengths matter. - Recognise privilege escalation paths: UID 0 accounts, NOPASSWD sudo and the docker group. - Explain why legacy trust files and service account shells are risky. ## Storing Passwords Linux stores password hashes in /etc/shadow. Modern algorithms such as yescrypt and SHA-512 crypt are salted and deliberately slow, so a stolen shadow file is expensive to crack. MD5-crypt and DES are fast and obsolete. Old hashes stay until each user changes their password. NIST SP 800-63B-4 favours length over complexity rules and asks for known-breached passwords to be blocked. It requires at least 15 characters when a password is the only factor, or 8 when it is used with another factor. It also requires limits on failed attempts. OpenVAPT flags a minimum below 15 characters and recommends a lockout after repeated failures. Together they make online guessing impractical. ## Who Is Really Root Root is not a name but user id 0. Extra UID 0 accounts, duplicate UIDs and NOPASSWD sudo rules all give root, often without a password. So does membership of the docker group, which can mount the host filesystem. Sudo should run commands in a pseudo-terminal and log them to a dedicated file, so privileged actions are recorded and cannot linger. ## Legacy Trust .rhosts and .shosts files trust whole machines instead of people, and .netrc files hold plain-text passwords. Legacy '+' NIS entries can import unexpected accounts. Service accounts should never have a login shell. ## In Summary Root is UID 0, not a name. Slow, salted hashing protects a stolen password file. Lockout slows guessing. NOPASSWD sudo and the docker group are root without a password. ## Apply It - [HOST-DKR-001 Users With Root-Equivalent Docker Access](https://openvapt.com/checks/HOST-DKR-001.md) (high) - [HOST-PWD-001 Weak Password Hashing Algorithm Configured](https://openvapt.com/checks/HOST-PWD-001.md) (medium) - [HOST-PWD-002 Accounts With Obsolete Password Hashes](https://openvapt.com/checks/HOST-PWD-002.md) (medium) - [HOST-PWD-003 Short Minimum Password Length](https://openvapt.com/checks/HOST-PWD-003.md) (low) - [HOST-PWD-004 No Account Lockout After Failed Logins](https://openvapt.com/checks/HOST-PWD-004.md) (medium) - [HOST-PWD-005 Forced Periodic Password Rotation Configured](https://openvapt.com/checks/HOST-PWD-005.md) (info) - [HOST-SUDO-001 Sudo Commands Not Logged to a Dedicated File](https://openvapt.com/checks/HOST-SUDO-001.md) (low) - [HOST-USR-001 Extra Accounts With Root Privileges (UID 0)](https://openvapt.com/checks/HOST-USR-001.md) (high) - [HOST-USR-002 Accounts Without a Password](https://openvapt.com/checks/HOST-USR-002.md) (high) - [HOST-USR-003 Sudo Rules Without Password (NOPASSWD)](https://openvapt.com/checks/HOST-USR-003.md) (high) - [HOST-USR-004 Duplicate User IDs](https://openvapt.com/checks/HOST-USR-004.md) (medium) - [HOST-USR-005 System Accounts With Login Shells](https://openvapt.com/checks/HOST-USR-005.md) (low) - [HOST-USR-006 Legacy NIS Entries in Account Files](https://openvapt.com/checks/HOST-USR-006.md) (medium) - [HOST-USR-007 Insecure Trust Files in Home Directories](https://openvapt.com/checks/HOST-USR-007.md) (high) - [HOST-USR-008 Duplicate Group IDs or Account Names](https://openvapt.com/checks/HOST-USR-008.md) (medium) - [HOST-USR-009 Password and Shadow Files Out of Step](https://openvapt.com/checks/HOST-USR-009.md) (medium) - [HOST-USR-010 Home Directories Accessible to Other Users](https://openvapt.com/checks/HOST-USR-010.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-DKR- --out p7` 2. `For each finding, explain how an attacker would turn it into root access.` 3. `On your own machine: getent group docker sudo wheel and review who is listed.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why is yescrypt or SHA-512 crypt preferred over MD5-crypt? - A. They are salted and deliberately slow to crack - B. They make passwords shorter - C. They encrypt the whole disk - D. They need no salt - Answer: A. Slow, salted hashing makes offline cracking of a stolen shadow file expensive. 2. Why is membership of the docker group dangerous? - A. It slows the server - B. It allows starting containers that mount the host filesystem, which is root access - C. It disables SSH - D. It gives read-only access to container logs - Answer: B. Control of Docker is equivalent to root on the host. 3. What does an account lockout policy defend against? - A. Password guessing - B. Disk failure - C. TLS downgrade - D. Session theft through XSS - Answer: A. Lockout limits repeated guesses against an account. 4. What does NIST SP 800-63B-4 favour for passwords? - A. Composition rules such as one symbol and one digit - B. Length, and blocking known-breached passwords - C. Changing every password every 30 days - D. Exactly 8 characters - Answer: B. NIST favours length over complexity rules and asks verifiers to block passwords known to be breached. 5. Why are .rhosts files risky? - A. They store password hashes - B. They trust whole machines instead of people - C. They make SSH slower - D. They disable sudo logging - Answer: B. Legacy trust files let anyone on a trusted machine in, without proving who they are. 6. The system now uses yescrypt. Why can old MD5-crypt hashes still be in /etc/shadow? - A. yescrypt cannot read them - B. A hash changes only when the user next changes their password - C. MD5 hashes can never be removed - D. /etc/shadow is read-only - Answer: B. Old hashes stay until each user changes their password, so a policy change needs follow-up. ## Key Terms - Least Privilege: Giving every account and process only the access it needs, nothing more. - Brute Force: Trying many passwords or keys in turn until one works. - Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root. - Password Hashing: Storing a one-way, salted, deliberately slow transformation of a password instead of the password itself. - Account Lockout: Temporarily blocking an account after repeated failed logins to stop password guessing. ## References - [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) - [MITRE ATT&CK T1548, Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/) Offline: `openvapt learn P7`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p7.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.