Lesson 4.1: Defence in depth and least privilege
Two principles behind almost every defensive decision. Defence in depth: several independent layers, so one failure doesn't mean a breach. Least privilege: every person and program gets only the access it needs, for as long as it needs it. In the lab you review who can become root on a server, take sudo away from an intern, narrow an automation account's rights to the one command it runs, and close a configuration file that anyone could read and change.
18 min
You will learn to
- Explain defence in depth with the layers of a real system
- Explain the principle of least privilege
- Find who can run commands as root with getent and sudo -l
- Remove a user from the sudo group and narrow a sudoers rule
- Find and fix a world-writable file
Key terms
- Defence in depth
- Several independent layers of protection, so that when one fails the next one still stands.
- Privilege
- What an account or program is allowed to do: read a file, change a setting, run a command as root.
- Least privilege
- Every person and program gets only the access needed for its job, and only for as long as it is needed.
- sudo
- Runs one command with another user's rights, usually root's, if a rule in /etc/sudoers or /etc/sudoers.d allows it.
- Privilege escalation
- Getting more rights than you were given, for example going from a normal account to root.
- Separation of duties
- Splitting a sensitive task between people, so no single person can complete it alone.
← Working with files and directories · All lessons · Spaces in paths and file names →