For Teachers · Back to the Module · Print with your browser's Print command.

P22 Worksheet: Authentication Policy and Package Hygiene

Student Worksheet (about 35 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P7, P15

Learning Objectives

• [ ] Explain what pam_pwquality, pam_faillock, pam_pwhistory and pam_wheel each decide, and read their options from a PAM stack.
• [ ] Explain the login.defs and useradd defaults that govern password age and inactive accounts, and where current NIST guidance differs from older practice.
• [ ] Recognise an unsafe root PATH and explain the privilege escalation it allows.
• [ ] Explain why repository signatures, third-party repositories, retained kernels and legacy services are patch management problems.

Key Terms

Write each definition in your own words.

• PAM: ______________________________________________
• Password History: ______________________________________________
• Path Interception: ______________________________________________
• Repository Signing: ______________________________________________
• Legacy Service: ______________________________________________
• Idle Timeout: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-PAM- --out p22a and read the common-password stacks in internal/lab/fixtures_audit_pam_pkg.go side by side.
2. Run: openvapt demo --only HOST-PKG- --out p22b and find the sources.list entry that fails HOST-PKG-002 and the one listed by HOST-PKG-003.
3. Run: openvapt demo --only HOST-SVC- --out p22c and, for each failed check, decide whether removing the package or disabling the unit would be the right fix on a real server.
4. On a test machine you own: sudo openvapt scan --only HOST-PAM-,HOST-PKG-,HOST-SVC- and compare with grep pam_ /etc/pam.d/common-password and dpkg -l | grep '^ii' .

Self-Check Questions

1. pwquality.conf sets minlen = 14, but /etc/pam.d/common-password has no pam_pwquality line. What is enforced?

• [ ] a) A 14-character minimum
• [ ] b) Nothing from pwquality: the module is never called
• [ ] c) Only a dictionary check
• [ ] d) A 14-character minimum for root only

1. Root's .bashrc sets PATH=.:/usr/bin:/bin. What can a local user do?

• [ ] a) Nothing: . is harmless
• [ ] b) Place a program named ls in a directory root will visit and have it run as root
• [ ] c) Read root's files
• [ ] d) Change root's password

1. A sources.list entry carries [trusted=yes]. What does apt skip for it?

• [ ] a) Downloading the package
• [ ] b) Verifying the repository signature
• [ ] c) Installing dependencies
• [ ] d) Checking free disk space

1. telnetd is installed but systemctl says telnet.socket is inactive. Why do the HOST-SVC checks still report it?

• [ ] a) Because active and installed are the same thing
• [ ] b) Because an installed service comes back with the next upgrade or reboot and is one command from running
• [ ] c) Because Telnet is encrypted
• [ ] d) Because the socket is always active anyway

1. Why does an installed kernel update not protect the machine straight away?

• [ ] a) The old kernel keeps running until the machine boots into the new one
• [ ] b) Kernels update themselves while running
• [ ] c) It needs a new licence first
• [ ] d) Updates are only downloaded, never installed

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• NIST SP 800-53 Rev. 5, IA-5, AC-7 and CM-7: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: https://csrc.nist.gov/pubs/sp/800/40/r4/final
• NIST SP 800-123, Guide to General Server Security: https://csrc.nist.gov/pubs/sp/800/123/final
• pam.conf(5), Linux man-pages (PAM configuration): https://man7.org/linux/man-pages/man5/pam.conf.5.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.