Unit 4: Users and groups · Lesson 3 of 7 · 15 min
Who can log in
Separate people from service accounts and list every account with a working shell.
mission
- You are
- You are shrinking the attack surface of web01.
- Situation
- Every account with a real shell is one more password or key an attacker can try.
- Goal
- List every account that can open an interactive shell.
- Hand in
- The count of login-capable accounts and the ones that should not have a shell.
Field 7 decides
- /bin/bashInteractive logins work
- /usr/sbin/nologinRefused with a message
- /bin/falseRefused silently
Filter out the blocked shells
Service accounts use /usr/sbin/nologin or /bin/false. Everything else can log in.
awk -F: '$7 !~ /nologin|false/ {print $1, $7}' /etc/passwd root /bin/bash sync /bin/sync learner /bin/bash dana /bin/bash omar /bin/bash sysops /bin/bash awk -F: '$7 !~ /nologin|false/' /etc/passwd | wc -l 6
you should see sync is a historical oddity whose shell just flushes the disk. The real question marks are omar, who left, and sysops.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
wc- Counts lines, words and bytes. Built into Linux and macOS.
People and services
UIDs from 1000 up are normally people. Below that are system accounts.
awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $3, $7}' /etc/passwd learner 1000 /bin/bash dana 1001 /bin/bash omar 1002 /bin/bash deploy 1003 /usr/sbin/nologin getent passwd sync sync:x:4:65534:sync:/bin:/bin/sync
you should see Three people with bash and the deploy service with nologin. sync's shell only runs the sync command.
getent- Looks up users, groups and hosts the way the system does. Built into Linux.
A person and a service
dana:x:1001:1001::/home/dana:/bin/bash
Can log in
deploy:x:1003:1003::/srv/app:/usr/sbin/nologin
Cannot open a shell
Write down the fix
As root, usermod -s /usr/sbin/nologin omar closes a shell and usermod -L locks the password. In the lab you cannot run them, which is correct: you only record the finding.
What a defender takes away
- 1Field 7 decides whether an account can log in.
- 2Leavers keep working shells until someone removes them.
- 3Record the fix, then confirm it with the same awk.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.