1

Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow anything that could be abused and that we didn't overlook anything. Since this is highly dependent on the user/org environment, software, etc. The most generic we can get is to find out what groups and users exist and what they do.

My first steps would be the following:

  • List all users with: cat /etc/passwd and cat /etc/shadow
  • List all the groups: cat /etc/group
  • List all sudo access: cat /etc/sudoers
  • List all accounts with UID 0: egrep ':0+' /etc/passwd
  • List the root SSH keys: cat /root/.ssh/authorized_keys

But this is where I'm stumped, what can we do with this information? How do we know it's the groups are what they seem to be and can't overstep their bounds? I can think of:

  • Listing the processes belonging to a user: ps aux | grep $USER
  • Listing files owned by a user/group: find / -user $USER or find / -group $GROUP (with | grep -v $HOMEDIR if we don't want to see stuff in our users home directories)
  • List all installed packages (only root can install, but we could use this as a reference to check which users/groups can access these applications) sudo dpkg --get-selections > installed-applications.txt

But that's as far as I've gotten so far.

Improve this question
4
  • 1
    I think you need to do some reading on how to do an IT Health Check.
    – Julian Knight
    Nov 12 '17 at 15:25
  • I'm not sure I understand what you mean @JulianKnight , from what I can gather, an IT Health Check is a general systems review. I only want to find out what access/permissions a particular user has.
    – Daniel V
    Nov 21 '17 at 17:08
  • It is a formal method for ensuring that a system and its platform and data centre are secure. It should be comprehensive. There are, of course, less comprehensive security validation processes. The point I was making is that you cannot expect to be able to just grab some bits of system info and use them to make the system secure. Security has to be process driven.
    – Julian Knight
    Nov 24 '17 at 9:16
  • I understand that security is process driven, but part of that process is identifying what privileges a system has, or document them from the start. What I was trying to ask is how to see what privileges are available to specific users in a Linux system. While I understand that it's ideal to have a thorough inventory from the start, it's possible that information doesn't exist or has been lost in the case of large orgs that are starting to incorporate best practices. I'm not sure if I'm expressing myself correctly?
    – Daniel V
    Nov 29 '17 at 17:55