Please enable JavaScript.
Coggle requires JavaScript to display documents.
Sudo - Least Privilege Access (PoLP), root ALL=(ALL:ALL) ALL, 🔐 1.…
Sudo - Least Privilege Access (PoLP)
🔐 1. Sudo - Least Privilege Access (PoLP)
📖 1.1 What is Sudo?
🔹 Sudo = Super User Do
🔹 Allows a normal user to execute commands as another user (usually root)
🔹 Temporary privilege elevation
🔹 Every sudo command is logged
🔹 Preferred over logging in directly as root
🔹 Centralized privilege management
🔹 Enterprise security standard
📖 1.2 What is Least Privilege?
🔹 Principle of Least Privilege (PoLP)
🔹 Users receive only the permissions required for their job
🔹 No unnecessary administrative privileges
🔹 Reduces attack surface
🔹 Prevents accidental damage
🔹 Limits insider threats
🔹 Limits malware impact
🔹 Meets compliance requirements
🎯 1.3 Enterprise Objectives
🔹 Secure privilege delegation
🔹 Accountability
🔹 Auditing
🔹 Separation of Duties (SoD)
🔹 Compliance
🔸 ISO 27001
🔸 PCI-DSS
🔸 NIST
🔸 CIS Controls
🔸 Saudi NCA ECC
🔹 Centralized administration
👤 2. Linux Users
📖 2.1 What is a User?
🔹 Human account
🔹 Service account
🔹 Application account
🔹 Automation account
📖 2.2 User Types
👑 1 Root User
🔹 UID 0
🔹 Full system control
👨2 Normal User
🔹 Limited permissions
🔹 Uses sudo for privileged tasks
⚙ 3 Service User
🔹 nginx
🔹 apache
🔹 mysql
🔹 postgres
🔹 docker
📂 User Database
/etc/passwd
🔹 User information
🔹 UID
🔹 GID
🔹 Home directory
🔹 Login shell
/etc/shadow
🔹 Password hashes
🔹 Password aging
🔹 Expiration
🛠 User Commands
id username
whoami
passwd username
useradd
usermod
userdel
chage
groups
👥 3. Linux Groups
📖 Why Groups?
🔹 Simplify permission management
🔹 Assign permissions to many users
📂 Group Database
/etc/group
Group Commands
groupadd
groupmod
groupdel
gpasswd
usermod -aG group username
groups username
Enterprise Groups
Linux_Admins
SOC
DevOps
Developers
Backup
Database
Security
Audit
🔑 4. Sudo Configuration Files
📂 Main File
/etc/sudoers
⚠ Never edit directly
Safe Editor
sudo visudo
Benefits
Syntax checking
Prevents corruption
File locking
Secure editing
Additional Configuration
/etc/sudoers.d/
Enterprise Practice
One file per team
Easier management
Easier auditing
Example
/etc/sudoers.d/linux_admins
/etc/sudoers.d/devops
/etc/sudoers.d/soc
/etc/sudoers.d/database
🧩 5. Understanding Sudo Rule
Example
bilal ALL=(ALL:ALL) ALL
Breakdown
bilal
User
First ALL
Host
Rule applies to all hosts
Second ALL
Run As User
Can become any user
Third ALL
Run As Group
Can become any group
Last ALL
Commands
Can execute all commands
🏠 6. Host Field
Purpose
Controls where rule applies
Examples
bilal server01=(ALL) ALL
bilal web01=(ALL) ALL
bilal db01=(ALL) ALL
bilal ALL=(ALL) ALL
👤 7. Run As User
Purpose
Which account sudo becomes
Examples
(root)
(mysql)
(nginx)
(postgres)
(backup)
Commands
sudo -u root command
sudo -u mysql mysql
sudo -u nginx bash
👥 8. Run As Group
Purpose
Execute with another group identity
Example
(root:backup)
(ALL:ALL)
Command
sudo -g backup command
⚙ 9. Command Restrictions
Allow Everything
ALL
Allow Single Command
/usr/bin/systemctl
Multiple Commands
/usr/bin/systemctl
/usr/bin/journalctl
/usr/bin/tail
Enterprise Examples
SOC
journalctl
tail
less
Backup
rsync
Database
mysql
mysqldump
Network
ip
iptables
nft
🚫 10. Deny Dangerous Commands
Example
ALL,
!/usr/bin/passwd root,
!/usr/bin/su
Prevent
Root password changes
Switching users
🔒 11. NOPASSWD
Example
bilal ALL=(root) NOPASSWD: /usr/bin/systemctl
Meaning
No password required
Enterprise Use
Automation
Ansible
Scripts
CI/CD
Avoid
NOPASSWD: ALL
🧱 12. Aliases
User Alias
User_Alias ADMINS = bilal,ali,ahmed
Command Alias
Cmnd_Alias SERVICES =
/usr/bin/systemctl,
/usr/bin/journalctl
Host Alias
Host_Alias WEBSERVERS =
web01,
web02
Run As Alias
Runas_Alias WEB =
nginx,
apache
🏢 13. Enterprise Team Examples
Linux Admin
%linux_admins ALL=(ALL) ALL
SOC
%soc ALL=(root)
/usr/bin/journalctl,
/usr/bin/tail,
/usr/bin/less
Developers
%developers ALL=(root)
/usr/bin/systemctl restart myapp
Database
%dbadmins ALL=(mysql)
/usr/bin/mysql,
/usr/bin/mysqldump
Backup
%backup ALL=(root)
/usr/bin/rsync
📊 14. Logging and Auditing
Log Files
/var/log/auth.log
Ubuntu
/var/log/secure
RHEL
CentOS
Rocky
AlmaLinux
journalctl
journalctl -xe
journalctl -u sudo
Check User Rights
sudo -l
🛡 15. Security Best Practices
Never enable root SSH login
Never share root password
Never use NOPASSWD ALL
Use groups instead of users
Grant minimum commands
Remove unused sudo access
Review logs regularly
Review sudoers monthly
Use MFA where available
Store configuration in Git
🏭 16. Enterprise Implementation Workflow
Create group
groupadd linux_admins
Add user
usermod -aG linux_admins bilal
Create sudo policy
sudo visudo
Or
sudo visudo -f /etc/sudoers.d/linux_admins
Add rule
%linux_admins ALL=(ALL) ALL
Verify
sudo -l
Test
sudo systemctl status sshd
Audit
journalctl
⚠ 17. Common Misconfigurations
Giving ALL commands unnecessarily
Using user rules instead of groups
Incorrect command path
Editing /etc/sudoers without visudo
Giving NOPASSWD ALL
Allowing shell access
/bin/bash
Allowing editors
vim
nano
Allowing wildcard abuse
*
🚨 18. Cybersecurity Risks
Privilege Escalation
Insider Threats
Malware Execution
Lateral Movement
Persistence
Audit Failures
Compliance Violations
🎓 19. Interview & RHCSA Knowledge
Explain sudo
Explain visudo
Explain /etc/sudoers
Explain /etc/sudoers.d
Explain ALL=(ALL:ALL) ALL
Difference between user and group rules
Explain NOPASSWD
Explain sudo -l
Explain least privilege
Explain command restrictions
Explain User_Alias
Explain Cmnd_Alias
Explain Host_Alias
Explain Runas_Alias
🏆 20. Enterprise Design Principles
🔹 Least Privilege (PoLP)
🔹 Separation of Duties (SoD)
🔹 Need-to-Know Access
🔹 Role-Based Access Control (RBAC)
🔹 Accountability
🔹 Auditability
🔹 Centralized Management
🔹 Defense in Depth
🔹 Secure Configuration Management
🔹 Compliance by Design
root ALL=(ALL:ALL) ALL
🔐 Linux Enterprise Sudoers User Privilege Specification
1️⃣ Introduction to sudo and sudoers
1.1 What is sudo?
sudo = Super User DO
Allows normal users to execute privileged commands
Provides controlled root access
Used instead of direct root login
Implements Principle of Least Privilege (PoLP)
1.2 What is sudoers?
Configuration file controlling sudo permissions
Main file location
/etc/sudoers
Additional configuration directory
/etc/sudoers.d/
Controls:
Users
Groups
Commands
Target users
Authentication behavior
1.3 Why enterprise uses sudo?
Accountability
Audit logging
Separation of duties
Reduced root exposure
Security compliance
ISO 27001
NIST Cybersecurity Framework
CIS Linux Benchmark
NCA ECC Controls
🔐 2️⃣ Understanding sudoers syntax
Format structure
USER HOST = (RUN AS USER : RUN AS GROUP) COMMANDS
Example:
root ALL=(ALL:ALL) ALL
Explanation:
root
Who receives permission
ALL
Where permission applies
=
Permission assignment operator
(ALL:ALL)
First ALL = Run as user
Second ALL = Run as group
ALL
Allowed commands
👑 3️⃣ Detailed explanation of root user
root
Linux super administrator account
UID = 0
Complete control over operating system
Can:
Modify system files
Manage users
Install software
Change permissions
Configure networking
Control services
Root home directory
/root
Root shell
/bin/bash
Check root account
Command:
id root
Output example:
uid=0(root) gid=0(root)
🌐 4️⃣ First ALL explanation
Host specification
root ALL=(ALL:ALL) ALL
↑
ALL means:
Any hostname
Any server
Any machine using this sudo configuration
Enterprise example:
root server01=(ALL:ALL) ALL
Means:
Root privilege only on server01
With ALL:
root ALL=(ALL:ALL) ALL
Means:
Applies everywhere
👤 5️⃣ Second ALL explanation
Run As User
root ALL=(ALL:ALL) ALL
↑
Controls:
Which user can execute commands
ALL means:
root can become any user
root
mysql
nginx
postgres
any Linux user
Example:
sudo -u nginx whoami
Output:
nginx
👥 6️⃣ Third ALL explanation
Run As Group
root ALL=(ALL:ALL) ALL
↑
Controls:
Which group permissions are used
ALL means:
Any group
Example:
sudo -u user -g group command
⚡ 7️⃣ Fourth ALL explanation
Allowed Commands
root ALL=(ALL:ALL) ALL
↑
Defines allowed commands
ALL means:
Every command
Examples:
sudo useradd bilal
sudo systemctl restart ssh
sudo apt install nginx
sudo rm file
No command restriction
📂 8️⃣ Important Linux sudo files
Main sudo configuration
/etc/sudoers
Directory for custom rules
/etc/sudoers.d/
Default configuration
/etc/sudoers
Check permissions
ls -l /etc/sudoers
Expected:
-r--r----- root root /etc/sudoers
🛠️ 9️⃣ Editing sudoers correctly
NEVER edit directly
nano /etc/sudoers
Use visudo
sudo visudo
Benefits:
Syntax checking
Prevents configuration mistakes
Locks file during editing
Protects sudo access
📁 🔟 Enterprise sudoers.d method
Create separate policy file
sudo visudo -f /etc/sudoers.d/linux_admins
Example:
%linux_admins ALL=(ALL) ALL
Advantages:
Easier management
Automation friendly
Configuration management compatible
Cleaner auditing
👨💻 1️⃣1️⃣ Users and groups implementation
Create user:
sudo useradd bilal
Set password:
sudo passwd bilal
Create admin group:
sudo groupadd linux_admins
Add user:
sudo usermod -aG linux_admins bilal
Verify:
groups bilal
🛡️ 1️⃣2️⃣ Principle of Least Privilege
Bad practice:
bilal ALL=(ALL) ALL
Problem:
Full root access
High security risk
No command control
Better:
bilal ALL=(root) /usr/bin/systemctl
Result:
Allowed:
sudo systemctl restart nginx
Blocked:
sudo useradd hacker
🔍 1️⃣3️⃣ Checking sudo permissions
Command:
sudo -l
Shows:
Allowed commands
Allowed users
Restrictions
📊 1️⃣4️⃣ Enterprise role based sudo design
Linux Administrator
%linux_admins ALL=(ALL) ALL
SOC Analyst
%soc_team ALL=(root) /usr/bin/journalctl
Database Team
%database ALL=(mysql) ALL
Web Team
%webadmin ALL=(root) /usr/bin/systemctl
🚨 1️⃣5️⃣ Security Monitoring
Sudo logs location:
Ubuntu/Debian:
/var/log/auth.log
RHEL/CentOS:
/var/log/secure
View sudo activity:
grep sudo /var/log/auth.log
Audit:
Who used sudo
When
Which command
Result
🏢 1️⃣6️⃣ Enterprise Best Practices
Disable direct root SSH login
/etc/ssh/sshd_config
PermitRootLogin no
Use named accounts
Never share root password
Enable sudo logging
Review permissions regularly
Remove unused sudo access
Use MFA for privileged accounts
Follow:
PoLP
Zero Trust
ISO 27001
CIS Benchmark
NIST Controls
🎯 Final Understanding
root ALL=(ALL:ALL) ALL
Means:
Root user
can execute
On any host
as any user
with any group
and run any command
This line represents:
"Unlimited administrative privilege"
🔐 1. Principle of Least Privilege (PoLP)
🔐 1. Principle of Least Privilege (PoLP)
📖 1.1 What is Principle of Least Privilege (PoLP)?
📚 Definition
Every user, process, application, service, container, virtual machine, API, and administrator receives only the minimum permissions required to perform its assigned task.
No unnecessary privileges should ever be granted.
Permissions are granted based on business requirements.
Additional privileges are granted only when approved.
Principle of Least Privilege (PoLP) is a cybersecurity security model.
🎯 Goal
Reduce attack surface
Reduce insider threats
Prevent privilege escalation
Protect confidential data
Improve compliance
Limit malware damage
Reduce ransomware impact
🏢 Enterprise Example
HR employee cannot access Finance server.
Developer cannot modify firewall.
SOC analyst cannot create users.
Database administrator cannot manage Active Directory.
Backup operator cannot delete production database.
🔥 Security Principle
Never give Administrator access by default.
Never use Root for daily work.
Grant permissions only when required.
Remove permissions immediately after task completion.
👤 2. Users and Identity
Normal User
UID greater than or equal to 1000
Limited permissions
Personal home directory
System User
Used by services
Usually UID less than 1000
No interactive login
Root User
UID 0
Unlimited permissions
Bypasses file permissions
Can modify kernel configuration
Can manage every process
Service Accounts
nginx
apache
mysql
postgres
elasticsearch
Important Files
/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow
👥 3. Groups
Primary Group
Secondary Groups
Project Groups
Administrative Groups
Service Groups
Commands
groupadd
groupdel
groupmod
gpasswd
groups
id
Enterprise Example
linux-admins
developers
soc-team
db-admins
backup-team
🔑 4. Linux Permissions
Owner
Group
Others
Permission Types
Read (r)
Write (w)
Execute (x)
Numeric Permissions
0 None
1 Execute
2 Write
3 Write Execute
4 Read
5 Read Execute
6 Read Write
7 Read Write Execute
Commands
chmod
chown
chgrp
umask
Important Commands
ls -l
stat
namei
🔐 5. sudo and visudo
sudo
Temporary privilege escalation
Logs every command
visudo
Secure editor
Validates syntax
Prevents file corruption
Configuration Files
/etc/sudoers
/etc/sudoers.d/
Enterprise Rules
%linux-admins ALL=(ALL) ALL
%soc-team ALL=(root) /usr/bin/journalctl
%backup-team ALL=(root) /usr/bin/rsync
%developers ALL=(root) /usr/bin/systemctl restart myapp
Commands
sudo -l
sudo -u username command
sudo visudo
Security
Never grant ALL commands unless required.
Prefer command-specific permissions.
Use groups instead of individual users.
📂 6. File Ownership
Owner
Group
Others
Commands
chown
chgrp
Shared Directory
SetGID
chmod g+s
Group inheritance
Sticky Bit
chmod +t
Example /tmp
🛡️ 7. Access Control Lists (ACL)
Why ACL
More flexible than chmod
Commands
getfacl
setfacl
Default ACL
Named User ACL
Named Group ACL
🔥 8. Special Permissions
SUID
SGID
Sticky Bit
Risks
Auditing
Commands
find / -perm -4000
find / -perm -2000
🔒 9. Mandatory Access Control
SELinux
Enforcing
Permissive
Disabled
Commands
sestatus
getenforce
setenforce
restorecon
semanage
AppArmor
🧾 10. Authentication and Authorization
PAM
LDAP
LDAP (Lightweight Directory Access Protocol)
LDAP is a protocol used to store, organize, and retrieve identity information from a centralized directory
Active Directory
Kerberos
Kerberos is a network authentication protocol that provides secure identity verification using tickets instead of sending passwords over the network.
It is the primary authentication system used by:
Microsoft Active Directory
Linux FreeIPA
Enterprise identity systems
SSSD
SSSD is a Linux service that provides centralized identity and authentication management.
It allows Linux systems to authenticate users from external identity providers instead of only using local files like:
MFA
📋 11. Logging and Auditing
auditd
journald
rsyslog
sudo logs
Important Paths
/var/log/secure
/var/log/auth.log
/var/log/audit/
/var/log/messages
🚨 12. Enterprise Monitoring
SIEM Integration
Wazuh
Elastic Stack
Splunk
Microsoft Sentinel
Detect
Unauthorized sudo
New privileged users
SUID creation
Permission changes
ACL modifications
🏛️ 13. Enterprise PoLP Implementation Workflow
1 Identify business roles.
2 Classify systems.
3 Classify sensitive data.
4 Create user groups.
5 Assign minimum permissions.
6 Use sudo instead of direct root login.
7 Restrict commands using sudoers.
8 Use ACL where needed.
9 Enable SELinux or AppArmor.
10 Enable auditd.
11 Forward logs to SIEM.
12 Review permissions regularly.
13 Remove unused accounts.
14 Remove unnecessary sudo rules.
15 Rotate credentials.
16 Perform quarterly access reviews.
17 Test disaster recovery.
18 Continuously monitor privilege escalation.
✅ 14. Enterprise Security Best Practices
Never work directly as root.
Disable direct root SSH login.
Use sudo for administrative tasks.
Grant only required commands.
Use role-based access control (RBAC).
Separate duties between teams.
Apply file permissions correctly.
Use ACL only when standard permissions are insufficient.
Audit privileged actions continuously.
Monitor for privilege escalation.
Remove inactive accounts immediately.
Use MFA for privileged accounts.
Review sudoers files regularly.
Enable centralized logging and SIEM monitoring.
Comply with CIS Benchmarks, NIST SP 800-53, NIST SP 800-171, ISO 27001, PCI DSS, and the Saudi National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC).
Visudo
🔐 Linux Enterprise visudo and Sudoers Management
1️⃣ Introduction to sudo and visudo
🔹 What is sudo
sudo = SuperUser DO
Purpose
Allow normal users to execute privileged commands
Security Goal
Principle of Least Privilege PoLP
Replace direct root login
Provides
Authentication
Authorization
Command control
Auditing
🔹 What is visudo
visudo = VI editor for sudo configuration
Full Meaning
Visual editor for sudoers file
Main Purpose
Safely edit sudo configuration
Validate syntax before saving
Prevent sudo configuration mistakes
Lock sudoers file during editing
🔹 Why Enterprise Uses visudo
Direct editing is dangerous
Wrong syntax can break sudo
Administrators may lose root access
Production outage risk
Enterprise Benefits
Syntax checking
Controlled changes
Audit compliance
Secure privilege management
2️⃣ Important Linux sudo Configuration Paths
📁 Main sudo configuration file
/etc/sudoers
Purpose
Main sudo policy file
Contains
Users permissions
Groups permissions
Commands allowed
Run-as permissions
📁 Additional sudo configuration directory
/etc/sudoers.d/
Enterprise Recommended Method
Create separate files
Avoid modifying main sudoers file
Examples
/etc/sudoers.d/linux-admins
/etc/sudoers.d/database-team
/etc/sudoers.d/security-team
📁 sudo logs
RHEL CentOS
/var/log/secure
Ubuntu Debian
/var/log/auth.log
systemd systems
journalctl
3️⃣ Opening sudoers with visudo
Command
sudo visudo
What happens
Opens /etc/sudoers
Checks syntax
Saves only valid configuration
Edit specific file
sudo visudo -f /etc/sudoers.d/admins
Example
sudo visudo -f /etc/sudoers.d/web-team
4️⃣ Sudoers File Syntax Structure
Format
USER HOST=(RUN AS USER : RUN AS GROUP) COMMANDS
Example
bilal ALL=(ALL:ALL) ALL
Breaking Every Term
👤 USER
Who receives permission
Examples
bilal
ahmed
john
User Group Example
%linuxadmins
% means group
🌐 HOST
Where rule applies
Example
ALL
Meaning
Any server
Specific Host
server01
Meaning
Only server01
👑 RUN AS USER
Who user can become
Example
(root)
Means
Execute as root
Example
(ALL)
Means
Execute as any user
Examples
sudo -u mysql command
sudo -u nginx command
👥 RUN AS GROUP
Controls target group
Example
(root:root)
Meaning
Run command as root user
Run with root group
Enterprise Example
(backup:backup)
⚙ COMMANDS
What commands user can execute
ALL
Any command
Specific command
/usr/bin/systemctl
/usr/bin/journalctl
5️⃣ Understanding ALL Keyword Completely
ALL means
No restriction
Everything allowed
First ALL
Host restriction
Example
bilal ALL=(root) ALL
Meaning
Bilal can sudo on every server
Second ALL
Run As restriction
Example
bilal ALL=(ALL) ALL
Meaning
Bilal can become any user
Third ALL
Command restriction
Example
bilal ALL=(root) ALL
Meaning
Bilal can execute all commands as root
Complete Meaning
bilal ALL=(ALL) ALL
User bilal
Any server
Any user
Any command
6️⃣ Enterprise User Permission Models
🟢 Linux Administrator
File
/etc/sudoers.d/linux-admins
Configuration
%linux-admins ALL=(ALL:ALL) ALL
Access
Full administrative control
🟡 Database Administrator
Example
%database-admins ALL=(mysql) /usr/bin/mysql
Allowed
MySQL administration
Restricted
Cannot manage OS
🔵 Web Administrator
Example
%webadmins ALL=(root) /usr/bin/systemctl restart nginx
Allowed
Restart nginx
Not allowed
User management
Package installation
🟣 Security Operations SOC
Example
%soc-team ALL=(root) /usr/bin/journalctl
Purpose
Read security logs
7️⃣ Creating Enterprise Groups
Create group
sudo groupadd linux-admins
Add users
sudo usermod -aG linux-admins bilal
Verify
groups bilal
8️⃣ Enterprise Sudo Examples
Example 1
Full Admin
%linux-admins ALL=(ALL:ALL) ALL
Example 2
Restart Services Only
%service-admins ALL=(root) /usr/bin/systemctl
Example 3
Backup Team
%backup-team ALL=(root) /usr/bin/rsync
Example 4
Security Monitoring
%soc-team ALL=(root) /usr/bin/tail /var/log/*
9️⃣ NOPASSWD Implementation
Purpose
Automation
Scripts
Service accounts
Example
backup ALL=(root) NOPASSWD:/usr/bin/rsync
Execute
sudo rsync
🔟 Command Aliases Enterprise Method
Purpose
Reduce duplicate rules
Example
Cmnd_Alias SERVICES=/usr/bin/systemctl,/usr/bin/service
Apply
%admins ALL=(root) SERVICES
1️⃣1️⃣ User Aliases
Example
User_Alias ADMINS=bilal,ahmed,john
Apply
ADMINS ALL=(ALL) ALL
1️⃣2️⃣ Security Best Practices
✅ Never edit directly
Avoid
nano /etc/sudoers
✅ Always use
sudo visudo
✅ Use sudoers.d
Modular configuration
✅ Apply Least Privilege
Give minimum required access
✅ Avoid
ALL=(ALL) ALL
For normal users
✅ Disable direct root login
/etc/ssh/sshd_config
PermitRootLogin no
1️⃣3️⃣ Auditing and Monitoring
Check user privileges
sudo -l
View sudo logs
Ubuntu
cat /var/log/auth.log
RHEL
cat /var/log/secure
Systemd audit
journalctl _COMM=sudo
1️⃣4️⃣ Enterprise Change Management
Request
User requests privilege
Approval
Manager approval
Implementation
Admin creates sudo rule
Validation
visudo -c
Testing
sudo -l
Monitoring
Review logs
1️⃣5️⃣ Troubleshooting sudo
Problem
sudo command not found
Solution
Install sudo
apt install sudo
yum install sudo
Problem
Syntax error
Solution
visudo -c
Problem
User denied permission
Check
sudo -l
1️⃣6️⃣ Enterprise Architecture Example
Users
Linux Admin Team
Database Team
Developer Team
SOC Team
Groups
linux-admins
database-admins
developers
soc-team
Sudo Policies
/etc/sudoers.d/
linux-admins
database-team
developer-team
soc-team
Logging
SIEM
ELK Stack
Splunk
Wazuh
1️⃣7️⃣ Final Enterprise Flow
👤 User Login
↓
🔐 Authentication
↓
📄 sudo policy check
/etc/sudoers
/etc/sudoers.d/
↓
✅ Authorization
User
Host
Run As
Command
↓
👑 Privileged Execution
↓
📊 Logging and Auditing
↓
🔎 SIEM Monitoring
SOD
🏢 Separation of Duties (SoD)
🏢 Separation of Duties (SoD) — Enterprise Linux Security Model
1️⃣ Introduction to Separation of Duties (SoD)
🔹 Definition of SoD
Separation of Duties means:
One person should not have complete control over a critical process
Purpose:
Prevent unauthorized actions
Prevent fraud
Reduce insider threats
Reduce accidental mistakes
Enforce security governance
🔹 SoD Security Principle
Traditional Model:
One Administrator
↓
Creates User
↓
Gives Permission
↓
Audits Activity
❌ High Risk
Enterprise Model:
User Administration Team
↓
Access Approval Team
↓
System Administration Team
↓
Security Monitoring Team
↓
Audit Team
✅ Controlled Access
2️⃣ SoD Core Concepts
🔐 Least Privilege Principle
Meaning:
Give minimum permission required to complete a task
Example:
Developer
❌ No root access
Linux Administrator
✅ System administration access
🔐 Privileged Access Management (PAM)
Meaning:
Control and monitor powerful accounts
Examples:
root
sudo users
service accounts
database administrators
🔐 Accountability
Every action must identify:
Who performed action?
When?
From where?
What command executed?
🔐 Dual Control
Critical action requires two people
Example:
Database deletion
DBA requests
↓
Manager approves
↓
DBA executes
🔐 Four Eyes Principle
Important operations require another person review
Example:
Firewall rule change
Engineer creates rule
Security team approves
Change applied
3️⃣ Enterprise Linux SoD Roles Design
👤 Role 1: Linux System Administrator
Responsibilities:
Install OS
Patch servers
Manage services
Manage storage
Access:
sudo privileges
Example:
systemctl
yum
apt
mount
Should NOT:
Approve own access
Audit own activity
👤 Role 2: Security Administrator
Responsibilities:
Security policies
Firewall
SELinux
Auditing
SIEM
Tools:
auditd
SELinux
OSSEC
Elastic SIEM
👤 Role 3: User Administrator
Responsibilities:
Create users
Disable users
Manage groups
Commands:
useradd
usermod
userdel
passwd
👤 Role 4: Database Administrator
Responsibilities:
Database management
Examples:
MySQL
PostgreSQL
Oracle
Should NOT:
Manage Linux root access
👤 Role 5: Auditor
Responsibilities:
Review logs
Check compliance
Access:
Read only
Should NOT:
Modify systems
👤 Role 6: Application Developer
Responsibilities:
Code
Deploy application
Should NOT:
Access production root
4️⃣ Linux User Separation Implementation
📁 Important Linux Files
/etc/passwd
Stores user accounts
Example:
username:x:UID:GID:comment:home:shell
/etc/shadow
Stores password hashes
/etc/group
Stores groups
/etc/sudoers
Controls sudo permissions
/etc/sudoers.d/
Custom sudo policies
5️⃣ Enterprise Group Design
Create Separate Teams
👨💻 Linux Admin Group
Create group:
groupadd linux_admins
Add user:
usermod -aG linux_admins bilal
🔐 Security Team Group
groupadd security_team
👥 Database Team
groupadd database_admins
📝 Audit Team
groupadd auditors
6️⃣ Sudo Based Separation of Duties
sudo Architecture
User
↓
sudo
↓
Policy Check
↓
Allowed Command
↓
Execute
7️⃣ Editing Sudo Policies
Never edit directly:
❌ nano /etc/sudoers
Use:
✅ visudo
Command:
sudo visudo
8️⃣ Enterprise sudoers Structure
File:
/etc/sudoers
Directory:
/etc/sudoers.d/
Example:
/etc/sudoers.d/linux_admins
9️⃣ Linux Administrator Sudo Policy
File:
/etc/sudoers.d/linux_admins
Content:
%linux_admins ALL=(ALL) ALL
Meaning:
%linux_admins
Group
ALL
Any host
(ALL)
Can become any user
ALL
Can execute any command
Access:
Full administration
10️⃣ Security Team Limited Sudo
File:
/etc/sudoers.d/security_team
Example:
%security_team ALL=(root) /usr/bin/journalctl
Allows:
View logs
Blocks:
User creation
Package installation
System modification
11️⃣ Database Administrator Separation
File:
/etc/sudoers.d/database_admins
Example:
%database_admins ALL=(mysql) ALL
Meaning:
Can become mysql user
Cannot become root
Test:
sudo -u mysql bash
12️⃣ Developer Access Control
Developers should not have:
sudo ALL
root shell
Example:
%developers ALL=(root) /usr/bin/systemctl restart app.service
Allowed:
Restart application
Blocked:
User management
Firewall changes
13️⃣ Auditor Read Only Access
Group:
auditors
Sudo rule:
%auditors ALL=(root) /usr/bin/cat /var/log/*
Can:
Read logs
Cannot:
Modify logs
14️⃣ Root Account Protection
Disable direct root login
File:
/etc/ssh/sshd_config
Change:
PermitRootLogin no
Restart:
systemctl restart sshd
15️⃣ SSH Access Separation
SSH Configuration:
/etc/ssh/sshd_config
Example:
AllowGroups linux_admins security_team
Restart:
systemctl restart sshd
16️⃣ Password Policy Separation
Files:
/etc/security/pwquality.conf
Configure:
Minimum password length
Complexity
History
17️⃣ PAM (Pluggable Authentication Module)
Location:
/etc/pam.d/
Controls:
Authentication
Password policy
MFA integration
18️⃣ MFA Implementation
Tools:
Google Authenticator PAM
Duo Security
Yubikey
PAM file:
/etc/pam.d/sshd
19️⃣ Command Logging
Enable sudo logging
File:
/etc/sudoers
Add:
Defaults logfile=/var/log/sudo.log
Check:
cat /var/log/sudo.log
20️⃣ Linux Audit Framework
Tool:
auditd
Install:
apt install auditd audispd-plugins
Service:
systemctl enable auditd
Logs:
/var/log/audit/audit.log
21️⃣ Audit Critical Actions
Monitor:
User creation
Password changes
Sudo usage
File changes
Example rule:
auditctl -w /etc/passwd -p wa
22️⃣ File Integrity Monitoring
Tools:
AIDE
Tripwire
OSSEC
Example:
aide --init
23️⃣ Change Management SoD
Enterprise Workflow:
Request Change
↓
Manager Approval
↓
Engineer Implementation
↓
Security Review
↓
Audit Verification
24️⃣ Production Environment Separation
Development
Developers
Testing
QA Team
Production
Limited Administrators
25️⃣ Privileged Account Management
Tools:
CyberArk
BeyondTrust
Hashicorp Vault
Controls:
Password rotation
Session recording
Approval workflow
26️⃣ Monitoring and SIEM Integration
Collect:
sudo logs
SSH logs
audit logs
Sources:
/var/log/auth.log
/var/log/secure
/var/log/audit/audit.log
27️⃣ Compliance Standards Using SoD
ISO 27001
Access Control
Privileged Access Management
NIST Cybersecurity Framework
Identity Management
Access Control
CIS Controls
Account Management
Access Control
28️⃣ Enterprise SoD Example Architecture
Employee
↓
Identity Management System
↓
Approval Workflow
↓
Linux Group Assignment
↓
sudo Policy
↓
System Access
↓
Audit Logging
↓
SIEM Monitoring
↓
Compliance Audit
29️⃣ Security Benefits of SoD
✅ Prevent privilege abuse
✅ Reduce insider threats
✅ Improve compliance
✅ Improve accountability
✅ Reduce accidental damage
✅ Improve incident investigation
30️⃣ Complete Enterprise Linux SoD Golden Rule
Nobody should:
Request access
Approve access
Implement access
Audit access
All by the same person
Separation creates:
Control
Visibility
Accountability
Security
ALL = User ko permission hai ke woh command kisi bhi Linux user ki identity mein run kar sakta hai.