MISSION LAB

Privilege Management (sudo/su)

< Shield House

MISSION OBJECTIVES

0/8 Complete

    PRIVILEGE MGMT INTEL

    MISSION BRIEFING

    A junior admin accidentally ran sudo rm -rf /var/log/* and wiped all logs. The sudoers file gives everyone unrestricted root. Implement proper RBAC with least-privilege sudo policies before more damage is done.

    Privilege Commands

    cat /etc/sudoers
    View sudoers rules
    sudo -l -U user
    List user's sudo privs
    visudo
    Safely edit sudoers
    usermod -aG group user
    Add user to group
    groups user
    Show group memberships
    su - user
    Switch to user (full login)
    Why This Matters
    The Principle of Least Privilege is foundational. If a user only needs to restart Apache, they should not be able to delete /var/log. RBAC (Role-Based Access Control) via sudoers groups is how enterprise Linux environments enforce this. CIS Benchmark 5.3.