Questions tagged [privileged-account]
A user account with permissions to perform administrative actions within an operating system or application.
72
questions
0
votes
0
answers
29
views
Recommendations for admins who administer multiple environments
What's the recommendation for an organisation with admins who administer multiple environments?
For example, we have the same administrator with privileged access to different Microsoft Entra Id ...
- 71
0
votes
0
answers
50
views
Are domain admin credentials cached when entered for approving a software installation?
From what I know, it's a bad practice to login to any workstation or server except domain controllers as a domain admin. I read that mimikatz or other malware can extract the hash of the password from ...
- 13
2
votes
0
answers
43
views
What to do in case of an MDM solution admin account takeover?
My company recently switched to an MDM solution to manage our Apple computers fleet. This is all good and well to maintain up-to-date software, and make handle lost/stolen laptop issues.
But I can ...
- 21
0
votes
0
answers
1k
views
ERROR kuhl_sekurlsa_acquireLSA from customized mimikatz
Tried to call sekurlsa::logonpasswords function from mimikatz main source, but I get ERROR hl_aaaurlsa_acquireLSA ; Logon list
The program is executed with Administrator cred and I'm sure there's no ...
- 1
1
vote
3
answers
2k
views
Is there really any benefit in having a separate local admin account
I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
1
vote
0
answers
79
views
Clarification on log4j Service Requirements [duplicate]
We're currently trying to prioritize our mitigations for CVE-2021-44228.
The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
1
vote
1
answer
373
views
How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?
If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps ...
- 5,747
0
votes
0
answers
114
views
How many emails and accounts an organization's administrator and developer should have?
Let's say there is a small organization called "Example" with the registered domain "example.com".
There is a person, Bob, who has full control over the organization's GitHub ...
0
votes
1
answer
386
views
How do I stop local users from bypassing the UAC on Windows 10?
I'm the admin for a Windows 10 machine with a few local users. While I understand there are other ways to bypass security with access to the physical machine, I'd like to protect against hacks that ...
- 304
1
vote
3
answers
821
views
Why is it not recommended to permanently use the root account for all tasks?
Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422
But I still fail to understand the reasoning behind this ...
- 5,747
4
votes
1
answer
1k
views
Why do I need root privileges to send a raw packet from a UNIX machine?
I was recently reading through the nmap port scanning documentation and it points out that to perform a SYN scan (-sS) you require root privileges because an unprivileged user cannot send raw packets. ...
- 98
3
votes
2
answers
2k
views
What are the security risks to have admin rights for a user account on Windows 10?
I am considering the security risks to have a standard user added to the Administrators group on an enterprise Windows 10 machine that is dedicated to that user. This is related to security only, so ...
- 9,028
0
votes
1
answer
156
views
server access to application owners
I am looking for the right practice to provide access to application owners. As of now they are part of system admins groups. whoever part of the group login tho the servers any time and do any stuff. ...
1
vote
2
answers
623
views
Setup guide for Privileged Access Workstation on Windows 10
I am setting up a Privileged Access Workstation (PAW) to access a whitelist of websites. Currently I have been following this guide on Github by unassassinable and applying the latest Windows 10 ...
- 111
3
votes
2
answers
187
views
Applying "principle of least privilege" when it comes to execs and owners of the company - should they automatically get all permissions if requested?
As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say ...
- 31
1
vote
1
answer
205
views
Risk of Docker backdoor allowing impersonation
I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.
I work in a company which is developing some ...
- 13
2
votes
0
answers
141
views
Best practices or advice to convince IT admins not to map network drives in privileged sessions with users
We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work.
Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
- 123
1
vote
2
answers
146
views
Insider threat mitigation sql databases
I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
- 47
1
vote
1
answer
255
views
Running jobs as local administrator vs domain administrator and their risks
I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
- 1,951
1
vote
3
answers
133
views
Is "permission (role) granting" safer, than giving direct access to primary account?
The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ).
However, I've been thinking about a specific security "threat" which might arise from that.
Let'...
- 2,727
2
votes
3
answers
454
views
What's the best practical way to protect our IT administrators?
We're a medium-sized enterprise with many different IT administrators (e.g. domain admins, Azure admins, DB admins, ...). We're worried that hackers can easily breach an admin's laptop and through ...
0
votes
0
answers
294
views
How to run command as privileged Windows service account against Active Directory domain controller?
I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test).
Since the account is a service account, it cannot be ...
- 1,207
0
votes
1
answer
286
views
Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?
There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc.
The only requirement for administrative access ...
3
votes
3
answers
323
views
Why is it recommended to use accounts without sysop rights for everyday work?
Another recommendation I fail to understand.
The explanation is that, if I use admin account and manage to have my computer infected, the malware is able to take control over my entire system. But:
...
- 5,747
1
vote
3
answers
298
views
Do large companies storing private user data ensure no single insider can abuse user data? if so, how?
Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
- 111
2
votes
2
answers
424
views
Does clicking "no" to "Do you want to allow the following program ... to make changes to this computer" mean I'm safe?
I recently got an unwanted exe automatically downloaded by my browser, and on going to delete it my useless trackpad registered misplaced my click and I ran it. I got the usual dialog about making ...
- 1,019
0
votes
1
answer
652
views
Mysql user privileges for update query
In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
- 139
1
vote
1
answer
453
views
Mysql Information schema column_privileges empty
I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose.
In one of these I obtain the table column_privileges (of Mysql Information schema) ...
- 139
21
votes
2
answers
8k
views
Backdoor account in passwd file
Long story short I was making sure a web app didn't create a LFI vuln by attempting to open /etc/passwd with it. My first attempt to prevent LFI was unsuccessful and listed out the file, and I noticed ...
- 353
3
votes
3
answers
405
views
Should inactive administrator accounts be DELETED/expunged?
Given:
A web application
Some active administrator accounts.
Some inactive administrator accounts.
No existing "audit" mechanism to keep old accounts for.
Inactive administrators cannot log in.
Is ...
- 133
79
votes
8
answers
11k
views
Should the sole user of a *nix system have two accounts?
Should the sole user of a *nix (particularly Linux and MacOS) have two accounts, one with sudo privileges and one without? Years ago I read that on your personal computer you should do your daily ...
- 905
34
votes
4
answers
5k
views
Why is it a bad idea for management to have constant access to every employee's inbox?
This was prompted by my CEO asking to get permanent access to everyone's inbox.
He wants for his email client to be configured so that as well as his own email account, he can see the contents/...
- 441
0
votes
3
answers
1k
views
Software installations without local admin rights
In the light of fewer technicians to visit sites and install software on to PC's, users are requesting Local Admin rights to do it themselves.
Is there a safe way or procedure of doing this for users ...
- 51
1
vote
2
answers
131
views
Why do websites still suffer from OS injections if by default web-servers are not assigned a shell?
So even if there is some poor php written which allows a shell_exec() and that someone disabled safe mode on it, what exactly are the risks? Do admins just change the default group or are most attacks ...
- 878
-1
votes
1
answer
327
views
How does the ERAD device gain access to your personal bank account?
I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts.
http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
- 109
3
votes
5
answers
2k
views
May be justified to use generic and shared user accounts in order to segregate and reduce risk?
Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional ...
- 1,507
3
votes
2
answers
8k
views
Default accounts shutdown, halt, and sync - still shipping?
I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document),
sync:x:5:0:sync:/sbin:/bin/...
- 1,345
1
vote
4
answers
3k
views
Is it safer to be setup as a user with 'standard' vs 'administrative' privileges in Windows 10?
I am setting up a relatives computer using Windows 10. I am going to create them a 'standard user' account which I will encourage them to use as their every day account.
In addition to that I will ...
- 445
2
votes
1
answer
1k
views
In Windows, what should I do to run a program with admin rights without concerns?
I'm currently using Windows 8.1 - 64 bits.
In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage).
There's a certain ...
3
votes
1
answer
139
views
Citations for Least Privilege network services?
The Principal of Least Privilege suggests that network services should not run with powerful and unnecessary capabilities. History teaches us that this is painfully necessary; 25 years ago Sendmail ...
- 72.7k
30
votes
4
answers
4k
views
Can the root user be removed from a *nix system to prevent privilege-escalation?
Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent super-...
- 1,239
1
vote
3
answers
204
views
Root access and malware
Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
- 1,129
5
votes
1
answer
168
views
How can I objectively evaluate trust in a person? (Systems Admin, or other)
When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively.
Is there any any guidance one should use ...
- 50.7k
3
votes
3
answers
10k
views
Is it dangerous to have the built-in Administrator account enabled?
I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it.
I do realize it's a ...
- 773
1
vote
1
answer
1k
views
Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?
I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
- 267
0
votes
1
answer
716
views
What's a least-privilege way to allow node.js to access network adapters on Linux?
Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
- 147
4
votes
4
answers
11k
views
Postfix master running as root
Does running /usr/lib/postfix/master as a root could cause a security threat ?
A fresh installation, gives this :
root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 /usr/lib/postfix/...
- 181
0
votes
1
answer
686
views
Limiting account access based upon NIC used to connect on Linux
I have a server which has multiple NICs (ignoring redundant pairs):
'inward' facing production (connects to other servers);
'outward' external facing production (connects out to the internet via a ...
0
votes
1
answer
568
views
How should privileged accounts be secured in both Linux and Windows?
I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
- 435
1
vote
2
answers
160
views
How many accounts should I have in an information system?
Is it a problem to have more than one account in an information system from security point of view?
Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
- 29