Security administration tasks

Auditing the system

find is the audit tool. find / -perm -4000 lists every SUID file — programs that run as their owner — and -perm -2000 lists SGID ones; an unexpected entry is a privilege escalation waiting to happen. find / -nouser -o -nogroup finds files left behind by a deleted account. Open ports are the other half: ss -tulpn, or nmap from another machine, answers what is actually reachable, and lsof -i lists which process holds which network file.

fuser answers the same shape of question about a filesystem rather than a socket, and it is what a umount refusing with "target is busy" is asking for. fuser -m /mnt/data reads the name as a FILESYSTEM — or as the block device backing one — and lists every process using anything on it, which is the point of -m: without it, fuser reports only on that one path. Each PID is marked with the kind of access, c for a current directory, e for a running executable, r for a root directory and m for a mapped file, so the output says why each process is holding the mount rather than only that it is. lsof +D /mnt/data answers the same question by walking the tree. Keep fuser -k for after you have decided those processes may die.

Who is logged in and who has been: w and who show current sessions, last reads /var/log/wtmp for logins and lastb reads /var/log/btmp for failed ones. An account with no password at all is found by scanning the second field of /etc/shadow, and passwd -l or a /usr/sbin/nologin shell is how one gets closed.

Two separate mechanisms in /etc/shadow are both spelled with chage, and the exam turns on telling them apart. PASSWORD AGEING says when the password must be replaced: -M maximum days, -m minimum days, -W the warning window before expiry, -I the inactive grace afterwards. ACCOUNT EXPIRY is a different field and disables the login as a whole whatever state the password is in: chage -E 2026-12-31 bob takes a date in YYYY-MM-DD form, or a count of days since the epoch, and usermod -e writes the same field. So a contractor who must lose access on a known date is -E, and a policy that a password be rotated every ninety days is chage -M 90 alice — for which passwd -x 90 alice is the identical instruction under the other command. Watch the CASE of the flags: -M and -m are maximum and minimum days, and swapping them is the standard distractor. chage -l alice prints the lot in words, which is how you confirm a change landed on the field you meant.

Shutting out EVERYBODY at once, for maintenance, is a different mechanism and a favourite question because it looks like it should be a command. It is a file: create /etc/nologin, and every non-root login is refused, with whatever you put in the file shown to the person turned away. Root is still let in, which is the point — the machine does not lock out the administrator doing the maintenance. Nothing has to be restarted; pam_nologin checks for the file on each login attempt, so the mere existence of it is the switch, and deleting it opens the machine again. shutdown creates and removes it for you as a scheduled shutdown approaches.

The two are worth keeping apart: /usr/sbin/nologin is a SHELL that refuses one account, named in that account's line in /etc/passwd; /etc/nologin is a FILE that refuses everyone. They differ by one slash and one directory and the exam has noticed.

$ echo "Down for patching until 20:00" > /etc/nologin# from another terminal, as an ordinary user:Down for patching until 20:00Connection closed by 192.168.1.10 port 22# root still gets in$ rm /etc/nologin

Limits and delegated privilege

/etc/security/limits.conf sets per-user and per-group resource limits — number of processes, open files, maximum memory, maximum logins — enforced by PAM at login. ulimit is the shell's view of the same thing: ulimit -a shows the current set, and a SOFT limit can be raised by the user up to the HARD limit, which only root can raise. That soft/hard distinction is the same idea as in disk quotas and is asked in the same way.

su switches user, and su - additionally runs the target's login scripts so you get their environment rather than yours — the difference is asked directly. sudo runs one command as another user, configured in /etc/sudoers and its drop-in directory /etc/sudoers.d/, and edited with visudo, which validates the syntax before saving; a broken sudoers file locks everybody out, which is why the validating editor exists. sudo logs what was run and by whom, which is the real argument for it over sharing a root password.