Unit 4: Users and groups · Lesson 2 of 7 · 15 min
Groups
Groups share access between accounts. Find out who can read the logs and who can become root.
mission
- You are
- You are mapping privileges on web01.
- Situation
- Two groups matter on almost every Ubuntu server: adm reads the logs and sudo runs anything as root.
- Goal
- List the members of each important group and explain your own access to the logs.
- Hand in
- Who is in sudo and which group lets you read auth.log.
List the groups that matter
getent group adm sudo ops devs adm:x:4:learner sudo:x:27:omar ops:x:2001:omar,deploy devs:x:2000:dana id omar uid=1002(omar) gid=1002(omar) groups=1002(omar),27(sudo),2001(ops) id dana uid=1001(dana) gid=1001(dana) groups=1001(dana),2000(devs)
you should see omar, the previous admin, is still in sudo after leaving. That is an access review finding.
Explain your own access
stat -c '%A %U %G %n' /var/log/auth.log /var/log/auth.log.1 -rw-r----- root adm /var/log/auth.log -rw-r----- root adm /var/log/auth.log.1 groups learner learner : learner adm
you should see The logs are group adm with group read, and you are in adm.
| Command | What it does |
|---|---|
id user | UID and every group |
groups user | Group names only |
getent group name | A group and its members |
stat -c '%U %G' file | Owner and group of a file |
Who holds root through a group
getent group sudo | cut -d: -f4 omar id -nG dana dana devs
you should see Only omar is in sudo. dana is in devs only.
defender tip Check sudo, admin and wheel groups on every review. Membership there is root.
What a defender takes away
- 1Group membership is access.
- 2sudo membership equals root. Review it first.
- 3Remove people from groups the day they leave.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.