Unit 4: Users and groups · Lesson 3 of 7 · 15 min
Who can log in
Separate people from service accounts and list every account with a working shell.
mission
- You are
- You are shrinking the attack surface of web01.
- Situation
- Every account with a real shell is one more password or key an attacker can try.
- Goal
- List every account that can open an interactive shell.
- Hand in
- The count of login-capable accounts and the ones that should not have a shell.
Field 7 decides
- /bin/bashInteractive logins work
- /usr/sbin/nologinRefused with a message
- /bin/falseRefused silently
Filter out the blocked shells
Service accounts use /usr/sbin/nologin or /bin/false. Everything else can log in.
awk -F: '$7 !~ /nologin|false/ {print $1, $7}' /etc/passwd root /bin/bash sync /bin/sync learner /bin/bash dana /bin/bash omar /bin/bash sysops /bin/bash awk -F: '$7 !~ /nologin|false/' /etc/passwd | wc -l 6
you should see sync is a historical oddity whose shell just flushes the disk. The real question marks are omar, who left, and sysops.
People and services
UIDs from 1000 up are normally people. Below that are system accounts.
awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $3, $7}' /etc/passwd learner 1000 /bin/bash dana 1001 /bin/bash omar 1002 /bin/bash deploy 1003 /usr/sbin/nologin getent passwd sync sync:x:4:65534:sync:/bin:/bin/sync
you should see Three people with bash and the deploy service with nologin. sync's shell only runs the sync command.
A person and a service
dana:x:1001:1001::/home/dana:/bin/bash
Can log in
deploy:x:1003:1003::/srv/app:/usr/sbin/nologin
Cannot open a shell
Write down the fix
As root, usermod -s /usr/sbin/nologin omar closes a shell and usermod -L locks the password. In the lab you cannot run them, which is correct: you only record the finding.
What a defender takes away
- 1Field 7 decides whether an account can log in.
- 2Leavers keep working shells until someone removes them.
- 3Record the fix, then confirm it with the same awk.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.