In this Slideshare from the webinar of CQURE Academy Security Expert, Krystian Zieja, you will gain insights into: - How sudo really works and what information we need to know before using it - Working with sudo logging and using sudo in combination with a central logging server as a security control - Session recording and replaying to analyze user behavior - The enterprise-wide sudoers file management -How to preventing common pitfalls of sudo configuration - LDAP Integration - Best practices for sudo usage You can watch the full, on-demand webinar here: https://www.beyondtrust.com/resources/webinar/sudo-mode-part-2-privilege-mistakes-dismantle-entire-enterprise/

1. The Sudo Mode Part 2:
How Privilege Mistakes Could
Dismantle Your Entire Enterprise
@paulacqure
@CQUREAcademy
CONSULTING
Krystian Zieja
CQURE: Security & Infrastructure Expert
CQURE Academy: Trainer
Email: Krystian@cqure.pl

2. Agenda

3. What is SUDO?
What sudo do:
delegate authority
run commands as root or other user
providing an audit trail of the
commands (accountability)
record user session
prevent password sharing

4. Sudo: How it works?
User submits a command via
sudo
i.e. sudo systemctl restart
httpd
sudo program checks /etc/sudoers
file
If user is allowed to use sudo, sudo
program executes the command

5. Sudoers file
Who Where (on
which
system)
Run As
(user:group)
Command
and
parameters
operators ALL NOPASSWD ALL
John sys1 printopr PRINTING
%helpdesk all ALL /usr/bin/add
user

6. Restrict your sudoers: Just required privileges

7. One to rule them all: distribute sudoers file

8. Local Rules Files
#includedir /etc/sudoers.d
It’s not a comment

9. Become another user: sudo not as a root

10. Glob pattern: danger wildcard in path

11. Securely edit files: How to prevent shell escape?

12. Prevent su command: enforce accountability

13. Tracing with sudo: grab all input and output

14. Sudoreplay: search, replay, watch and relax

15. PowerBroker for
Unix and Linux
Comprehensive Unix & Linux Privilege
and Session Management to Protect
Your Most Critical Systems

16. Endpoint Privilege
Management
Remove excessive user privileges
and control applications on endpoints
WINDOWS | MAC
Enterprise Password
Security
Provide accountability and control over
privileged credentials and sessions
APPS | DATABASES | DEVICES
SSH KEYS | CLOUD | VIRTUAL
Server Privilege
Management
Control, audit and simplify access for
DevOps and business-critical systems
UNIX | LINUX | WINDOWS
ASSET & ACCOUNT
DISCOVERY
THREAT & VULNERABILITY
INTELLIGENCE &
BEHAVIORAL ANALYTICS
REPORTING &
CONNECTORS
POLICY & ACTION
RESPONSE
THE POWERBROKER PRIVILEGED ACCESS MANAGEMENT PLATFORM
BeyondInsight

17. PowerBroker for Unix & Linux:
• Eliminates the sharing of privileged credentials and delegate
permissions without exposing credentials
• Tracks, logs and audits activities performed on Unix and
Linux systems for compliance
• System level control provides powerful file and folder
controls, not just command line analysis

18. Is Sudo Enough?
Logs are not tamper-proof -> You can’t prove compliance
beyond just a checkbox
No official support or QA testing -> If it’s hacked, there is
no one there to help
Complex to manage on multiple hosts -> Inconsistency
leads to gaps, and gaps lead to risk of exploit
or misuse

19. PowerBroker for Unix & Linux
Dynamic
Access Policy
Fine-Grained
Least
Privilege
Privileged
Threat
Analytics
Remote
System &
Application
Control
Auditing &
Governance
File &
Policy
Integrity
Monitoring
Privilege
Management
Best Practices
Privilege management
solution that helps
security and IT
organizations achieve
compliance, control
privileged access, and
prevent and contain
breaches
• Monitor and audit
sessions
• Reduce attack surfaces
• Analyze behavior
• Centralize policy,
management and
reporting

20. Centralized by Design
PowerBroker for Unix & Linux was designed to operate centrally from
day one. With all the controls and audit data being centrally
accessible even under the most extreme load. Highly flexible,
infinitely granular, yet simple to use:
• Centralized Policies
• Centralized Logs
• Centralized Session Recordings
• Remote Host Control
• Powerful Policy Language
• High Availability and Highly Scalable

21. Advanced Control and Audit
PowerBroker for Unix & Linux controls access to files at the system
level, not at the command level. This provides advanced capabilities
such as:
• Auditing activities inside scripts
• Controlling file and folder
access, even for root
• Block malicious and
tampered binaries

22. File Integrity Monitoring
A critical part of Privilege Management is making sure that the ‘things’
you allow to be elevated, and the processes that perform the
elevation, have not been compromised. As such, File Integrity
Monitoring is a must for all organizations:
• Centralized Management
• Built-in to PAM Solution
• Target Files and/or Folders
• Track target changes on:
Name Location
File Size Date and Time
Ownership Hash
Permissions Policy Violations

23. Detailed Forensics and Reporting
• Searchable Index
• Scheduled Reports
• Custom Reporting
• Single Events Window

24. How Does it Work?

25. Product Demonstration

26. Quick Poll + Q&A
Thank you for attending!