Lesson 1.5: The attack surface of a host
What system security protects: one machine, its accounts, its services, its files and its configuration. How an attacker who gets a foothold as an ordinary user tries to become root (privilege escalation), and how a defender takes stock first: which services listen, which accounts can log in, who may use sudo, which programs run with root rights. In the lab you inventory a Northwind application server in five commands and find four things that shouldn't be there.
16 min
You will learn to
- Define privilege escalation and hardening
- List listening services and running units
- List accounts that can log in
- List sudo users and SUID programs
- Turn an inventory into findings
Key terms
- Privilege escalation
- Gaining more rights than you were given, for example going from a normal user to root or SYSTEM.
- Foothold
- The first, limited access an attacker gets on a system.
- Hardening
- Reducing a system's attack surface and tightening its settings: removing what isn't needed, restricting what remains.
- SUID
- A file permission that makes a program run with its owner's rights instead of the caller's.
- Least privilege
- Every account and program gets only the rights it needs.
← What is a computer network? · All lessons · Anatomy of a web application →