Access control on Linux: accounts, sudo, SSH and service permissions
You audit account policy, PAM, sudo rules, privilege-granting groups, service users and systemd hardening on Linux, get to know AppArmor and SELinux, and watch critical changes with auditd.
Level 201 · 17 lessons · 15 practice labs
Lessons
Accounts
- Account policy: password age, lockout, inactive accounts
- UID 0 accounts and service accounts with a login shell
- Reading the PAM configuration
- Short task: bring the account policy up to the company standard
Privilege
- Reading sudoers: who, where, what
- Risky sudo rules: wildcards and programs that can open a shell
- Groups that grant privilege: docker, disk, adm, lxd
- Auditing polkit rules
- Short task: narrow the sudo rules and test the effect
Services
- Which user each service runs as
- systemd unit hardening options
- SSH access restrictions and key permissions
- Mandatory access control: introduction to AppArmor and SELinux
- Short task: run a web service under its own user with a restricted unit
Monitoring
- Watching critical files and commands with auditd
- Reading authentication logs
- Capstone: harden a Linux server’s access control from end to end
Practice labs
- Bring password ageing and inactive-account settings to standard: Set default password ageing and inactive-account lock to the standard and apply them to existing accounts.
- Find UID 0 accounts and service accounts with login shells: Find any non-root UID 0 account and service accounts with login shells, remove the shells and verify.
- Apply lockout and password quality rules with PAM: Read the PAM configuration, add failed-attempt lockout and the quality module, and test with a test account.
- Turn sudoers rules into a who, where, what table: Read all rules in the main file and drop-in directory and write each as one table row.
- Narrow sudo rules with wildcards or shell-capable programs: Find risky rules, restrict them to exact commands and arguments, and test the user can still do the job.
- Audit privilege-granting groups and polkit rules: Review docker, disk, adm and lxd memberships and polkit rules, remove unneeded rights and report.
- Audit which user each service runs as: List services running as root and mark those that can move to a dedicated user.
- Run a web service under its own user and a restricted unit: Give the service its own user, add systemd hardening options and show its exposure score improved.
- Restrict a service's access with an AppArmor profile: Build a complain-mode profile, review violations, switch to enforce and confirm a forbidden path is blocked.
- Audit and fix SSH key file permissions: Fix ownership and permissions of key and authorized_keys files in user home directories.
- Restrict SSH login to an allowed group: Disable root login, limit logins to one group and confirm a disallowed account is refused.
- Find and remove orphaned and stale authorised SSH keys: Match authorised keys on Göktaşı Yazılım's server to the staff list, remove orphaned ones and update the access table.
- Summarise failed logins from authentication logs: Count failed logins by source and account and flag the unusual one.
- Watch critical files and commands with auditd: Add watch rules for sudoers, shadow and SSH config, make a change and find the record.
- Harden a Linux server's access control end to end: Harden accounts, sudo, services and SSH on Pusulaya Sigorta's server, set up monitoring and write a before-and-after report.
About this course
You audit account policy, PAM, sudo rules, privilege-granting groups, service users and systemd hardening on Linux, get to know AppArmor and SELinux, and watch critical changes with auditd.
What you will learn
- Accounts
- Privilege
- Services
- Monitoring
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.