Security Fundamentals and Access Control
Security Fundamentals and Access Control tests identity, authorization, and hardening. Expect user and group management, sudo policy, SSH key hygiene, mandatory access control, and the principle of least privilege.
Accounts and privilege
- /etc/passwd stores account metadata; /etc/shadow stores password hashes and aging; never make shadow world-readable.
- useradd -m -s /bin/bash alice creates a home and shell; passwd alice sets the password; usermod -aG sudo alice adds a supplementary group.
- sudo rules live in /etc/sudoers and /etc/sudoers.d; always edit with visudo, which validates syntax.
Hardening
- SSH: disable root login and password authentication where keys are used; ~/.ssh must be 700 and authorized_keys 600.
- SELinux modes are enforcing, permissive, and disabled; AppArmor profiles are enforced or complain. Do not disable MAC to solve a denial; read the audit log.
- Keep packages patched, restrict listening services with a firewall, and centralize logs.
Worked example
Allow the deploy user to restart only nginx without a password. Run visudo -f /etc/sudoers.d/deploy and add: deploy ALL=(root) NOPASSWD: /bin/systemctl restart nginx Reasoning: the rule names the absolute command and arguments, so the user cannot run arbitrary systemctl subcommands or edit the unit file. Verify with sudo -l -U deploy.
Traps
- Editing sudoers directly and breaking sudo.
- Applying chmod 777 to private keys or home directories.
- Confusing authentication, which establishes identity, with authorization, which grants actions.
- Putting passwords in scripts or shell history.