For Teachers · Back to the Module · Print with your browser's Print command.

P15 Worksheet: Access Control: Accounts, Sudo and Logins

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P2, P7

Learning Objectives

• [ ] Tell authentication and authorisation apart and explain why both are needed.
• [ ] Identify login paths that bypass access control: empty passwords, service accounts with shells, direct root login.
• [ ] Explain what sudo rules, lockout and SSH authentication settings each enforce.
• [ ] Explain why the permissions on account files and the default umask are access control too.

Key Terms

Write each definition in your own words.

• Authentication: ______________________________________________
• Authorisation: ______________________________________________
• Least Privilege: ______________________________________________
• Default Deny: ______________________________________________
• Account Lockout: ______________________________________________
• Separation of Duties: ______________________________________________
• Login Shell: ______________________________________________
• PAM: ______________________________________________
• umask: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-USR-,HOST-PWD-,HOST-SUDO-,HOST-SSH-001,HOST-SSH-003,HOST-FS-001 --out p15
2. For each failed check, write one line: who gets in, or what they can do, that they should not.
3. Run: openvapt explain HOST-PWD-004 and read how pam_faillock is detected in both PAM positions.
4. On your own machine: awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd and ask why each listed account needs a shell.
5. On your own machine: sudo -l and read your own sudo rules. Which ones carry NOPASSWD, and why?

Self-Check Questions

1. A user logs in with a strong password and runs a command through a NOPASSWD sudo rule. What is weak here?

• [ ] a) Authentication
• [ ] b) Authorisation
• [ ] c) Encryption
• [ ] d) Logging

1. Why should service accounts such as www-data have a nologin shell?

• [ ] a) It makes the service start faster
• [ ] b) Nothing should ever log in as them, so the door is closed
• [ ] c) It hides the account from /etc/passwd
• [ ] d) It stops the service writing logs

1. What does PAM faillock enforce?

• [ ] a) A minimum password length
• [ ] b) A temporary lock after repeated failed logins
• [ ] c) Key-based SSH authentication
• [ ] d) A dedicated sudo log file

1. Why is a world-readable /etc/shadow a High finding even though nobody can write to it?

• [ ] a) It lets any local user copy the hashes and crack them offline
• [ ] b) It stops users changing their passwords
• [ ] c) It makes logins slower
• [ ] d) It disables sudo

1. What does a default umask of 022 mean for a report an administrator saves?

• [ ] a) Only root can read it
• [ ] b) Every local user can read it
• [ ] c) It is encrypted at rest
• [ ] d) It is deleted on reboot

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-53 Rev. 5, Security and Privacy Controls (AC and IA families): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• sudoers(5) manual: https://www.sudo.ws/docs/man/sudoers.man/
• pam_faillock(8) manual: https://man7.org/linux/man-pages/man8/pam_faillock.8.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.