Unit 4: Users and groups · Lesson 1 of 7 · 18 min
Accounts in /etc/passwd
One line per account, seven fields, and the one number the kernel really checks.
mission
- You are
- You are running an account review on web01.
- Situation
- The handover asks you to review who can log in. The newest account in /etc/passwd looked odd when you read the file's tail.
- Goal
- Read the account list field by field and find anything with root's power.
- Hand in
- Every account with UID 0 and the shell of the deploy account.
Start with yourself
id uid=1000(learner) gid=1000(learner) groups=1000(learner),4(adm) grep -E '^(deploy|omar|dana):' /etc/passwd dana:x:1001:1001::/home/dana:/bin/bash omar:x:1002:1002::/home/omar:/bin/bash deploy:x:1003:1003::/srv/app:/usr/sbin/nologin
you should see ^ anchors the pattern to the start of the line, so only user names match.
Ask awk who is root
The kernel trusts the UID, field 3, not the name. Any account with UID 0 is root.
awk -F: '$3 == 0' /etc/passwd
root:x:0:0:root:/root:/bin/bash
sysops:x:0:0::/root:/bin/bash
you should see Two roots. A second UID 0 account with a bland name is a classic backdoor, and every action it takes is logged as root.
defender tip Add this check to every audit. Later you will find out exactly when and how sysops was created.
List the people
On Ubuntu, accounts for people start at UID 1000. Lower numbers belong to services.
awk -F: '$3 >= 1000 && $3 < 65000 {print $1, $3}' /etc/passwd
learner 1000
dana 1001
omar 1002
deploy 1003
What a defender takes away
- 1/etc/passwd has seven colon-separated fields.
- 2UID 0 is root, whatever the name.
- 3awk -F: lets you test any field.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.