Lesson 4.48: A quarterly access review
Access tends to grow and rarely shrinks: people change teams, contractors leave, service accounts get a shell 'just for testing'. An access review regularly answers three questions for each server: who can log in, who can become root, and with which keys. Standards such as ISO 27001 and PCI DSS require these reviews, but the real reason is that forgotten access is how many intrusions start. In the lab you review web02, find a former colleague still in sudo and a backup key that works from anywhere, and fix both.
15 min
You will learn to
- List accounts with a login shell
- List who can use sudo
- Use last-login data to spot stale accounts
- Find and read authorized_keys files
- Restrict a service key with from= and command=
Key terms
- Access review
- A periodic check that every account and privilege is still needed.
- Least privilege
- Each account gets only what its job needs, and only while it needs it.
- Service account
- An account used by a program, not a person.
- lastlog
- Shows each account's most recent login.
- Key options
- Restrictions written before a key in authorized_keys.
← Hard and symbolic links · All lessons · sudo session recording and safe sudo rules →