Please enable JavaScript.
Coggle requires JavaScript to display documents.
🏢 Separation of Duties (SoD) Visudo - Coggle Diagram
🏢 Separation of Duties (SoD)
Visudo
🏢 Separation of Duties (SoD) — Enterprise Linux Security Model
1️⃣ Introduction to Separation of Duties (SoD)
🔹 Definition of SoD
Separation of Duties means:
One person should not have complete control over a critical process
Purpose:
Prevent unauthorized actions
Prevent fraud
Reduce insider threats
Reduce accidental mistakes
Enforce security governance
🔹 SoD Security Principle
Traditional Model:
One Administrator
↓
Creates User
↓
Gives Permission
↓
Audits Activity
❌ High Risk
Enterprise Model:
User Administration Team
↓
Access Approval Team
↓
System Administration Team
↓
Security Monitoring Team
↓
Audit Team
✅ Controlled Access
2️⃣ SoD Core Concepts
🔐 Least Privilege Principle
Meaning:
Give minimum permission required to complete a task
Example:
Developer
❌ No root access
Linux Administrator
✅ System administration access
🔐 Privileged Access Management (PAM)
Meaning:
Control and monitor powerful accounts
Examples:
root
sudo users
service accounts
database administrators
🔐 Accountability
Every action must identify:
Who performed action?
When?
From where?
What command executed?
🔐 Dual Control
Critical action requires two people
Example:
Database deletion
DBA requests
↓
Manager approves
↓
DBA executes
🔐 Four Eyes Principle
Important operations require another person review
Example:
Firewall rule change
Engineer creates rule
Security team approves
Change applied
3️⃣ Enterprise Linux SoD Roles Design
👤 Role 1: Linux System Administrator
Responsibilities:
Install OS
Patch servers
Manage services
Manage storage
Access:
sudo privileges
Example:
systemctl
yum
apt
mount
Should NOT:
Approve own access
Audit own activity
👤 Role 2: Security Administrator
Responsibilities:
Security policies
Firewall
SELinux
Auditing
SIEM
Tools:
auditd
SELinux
OSSEC
Elastic SIEM
👤 Role 3: User Administrator
Responsibilities:
Create users
Disable users
Manage groups
Commands:
useradd
usermod
userdel
passwd
👤 Role 4: Database Administrator
Responsibilities:
Database management
Examples:
MySQL
PostgreSQL
Oracle
Should NOT:
Manage Linux root access
👤 Role 5: Auditor
Responsibilities:
Review logs
Check compliance
Access:
Read only
Should NOT:
Modify systems
👤 Role 6: Application Developer
Responsibilities:
Code
Deploy application
Should NOT:
Access production root
4️⃣ Linux User Separation Implementation
📁 Important Linux Files
/etc/passwd
Stores user accounts
Example:
username:x:UID:GID:comment:home:shell
/etc/shadow
Stores password hashes
/etc/group
Stores groups
/etc/sudoers
Controls sudo permissions
/etc/sudoers.d/
Custom sudo policies
5️⃣ Enterprise Group Design
Create Separate Teams
👨💻 Linux Admin Group
Create group:
groupadd linux_admins
Add user:
usermod -aG linux_admins bilal
🔐 Security Team Group
groupadd security_team
👥 Database Team
groupadd database_admins
📝 Audit Team
groupadd auditors
6️⃣ Sudo Based Separation of Duties
sudo Architecture
User
↓
sudo
↓
Policy Check
↓
Allowed Command
↓
Execute
7️⃣ Editing Sudo Policies
Never edit directly:
❌ nano /etc/sudoers
Use:
✅ visudo
Command:
sudo visudo
8️⃣ Enterprise sudoers Structure
File:
/etc/sudoers
Directory:
/etc/sudoers.d/
Example:
/etc/sudoers.d/linux_admins
9️⃣ Linux Administrator Sudo Policy
File:
/etc/sudoers.d/linux_admins
Content:
%linux_admins ALL=(ALL) ALL
Meaning:
%linux_admins
Group
ALL
Any host
(ALL)
Can become any user
ALL
Can execute any command
Access:
Full administration
10️⃣ Security Team Limited Sudo
File:
/etc/sudoers.d/security_team
Example:
%security_team ALL=(root) /usr/bin/journalctl
Allows:
View logs
Blocks:
User creation
Package installation
System modification
11️⃣ Database Administrator Separation
File:
/etc/sudoers.d/database_admins
Example:
%database_admins ALL=(mysql) ALL
Meaning:
Can become mysql user
Cannot become root
Test:
sudo -u mysql bash
12️⃣ Developer Access Control
Developers should not have:
sudo ALL
root shell
Example:
%developers ALL=(root) /usr/bin/systemctl restart app.service
Allowed:
Restart application
Blocked:
User management
Firewall changes
13️⃣ Auditor Read Only Access
Group:
auditors
Sudo rule:
%auditors ALL=(root) /usr/bin/cat /var/log/*
Can:
Read logs
Cannot:
Modify logs
14️⃣ Root Account Protection
Disable direct root login
File:
/etc/ssh/sshd_config
Change:
PermitRootLogin no
Restart:
systemctl restart sshd
15️⃣ SSH Access Separation
SSH Configuration:
/etc/ssh/sshd_config
Example:
AllowGroups linux_admins security_team
Restart:
systemctl restart sshd
16️⃣ Password Policy Separation
Files:
/etc/security/pwquality.conf
Configure:
Minimum password length
Complexity
History
17️⃣ PAM (Pluggable Authentication Module)
Location:
/etc/pam.d/
Controls:
Authentication
Password policy
MFA integration
18️⃣ MFA Implementation
Tools:
Google Authenticator PAM
Duo Security
Yubikey
PAM file:
/etc/pam.d/sshd
19️⃣ Command Logging
Enable sudo logging
File:
/etc/sudoers
Add:
Defaults logfile=/var/log/sudo.log
Check:
cat /var/log/sudo.log
20️⃣ Linux Audit Framework
Tool:
auditd
Install:
apt install auditd audispd-plugins
Service:
systemctl enable auditd
Logs:
/var/log/audit/audit.log
21️⃣ Audit Critical Actions
Monitor:
User creation
Password changes
Sudo usage
File changes
Example rule:
auditctl -w /etc/passwd -p wa
22️⃣ File Integrity Monitoring
Tools:
AIDE
Tripwire
OSSEC
Example:
aide --init
23️⃣ Change Management SoD
Enterprise Workflow:
Request Change
↓
Manager Approval
↓
Engineer Implementation
↓
Security Review
↓
Audit Verification
24️⃣ Production Environment Separation
Development
Developers
Testing
QA Team
Production
Limited Administrators
25️⃣ Privileged Account Management
Tools:
CyberArk
BeyondTrust
Hashicorp Vault
Controls:
Password rotation
Session recording
Approval workflow
26️⃣ Monitoring and SIEM Integration
Collect:
sudo logs
SSH logs
audit logs
Sources:
/var/log/auth.log
/var/log/secure
/var/log/audit/audit.log
27️⃣ Compliance Standards Using SoD
ISO 27001
Access Control
Privileged Access Management
NIST Cybersecurity Framework
Identity Management
Access Control
CIS Controls
Account Management
Access Control
28️⃣ Enterprise SoD Example Architecture
Employee
↓
Identity Management System
↓
Approval Workflow
↓
Linux Group Assignment
↓
sudo Policy
↓
System Access
↓
Audit Logging
↓
SIEM Monitoring
↓
Compliance Audit
29️⃣ Security Benefits of SoD
✅ Prevent privilege abuse
✅ Reduce insider threats
✅ Improve compliance
✅ Improve accountability
✅ Reduce accidental damage
✅ Improve incident investigation
30️⃣ Complete Enterprise Linux SoD Golden Rule
Nobody should:
Request access
Approve access
Implement access
Audit access
All by the same person
Separation creates:
Control
Visibility
Accountability
Security