Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow anything that could be abused and that we didn't overlook anything. Since this is highly dependent on the user/org environment, software, etc. The most generic we can get is to find out what groups and users exist and what they do.
My first steps would be the following:
- List all users with:
cat /etc/passwd
andcat /etc/shadow
- List all the groups:
cat /etc/group
- List all sudo access:
cat /etc/sudoers
- List all accounts with UID 0:
egrep ':0+' /etc/passwd
- List the root SSH keys:
cat /root/.ssh/authorized_keys
But this is where I'm stumped, what can we do with this information? How do we know it's the groups are what they seem to be and can't overstep their bounds? I can think of:
- Listing the processes belonging to a user:
ps aux | grep $USER
- Listing files owned by a user/group:
find / -user $USER
orfind / -group $GROUP
(with| grep -v $HOMEDIR
if we don't want to see stuff in our users home directories) - List all installed packages (only root can install, but we could use this as a reference to check which users/groups can access these applications)
sudo dpkg --get-selections > installed-applications.txt
But that's as far as I've gotten so far.