And look at this, you've reached the end of another module.
Look at this, this is just amazing.
So we've been managing our user access here, and we've looked at things
such as disk quotas, so looking at ways that we can restrict the space
that a user might have to a certain file system.
And again,
this might cause problems because they are a little bit concerned
as why some people can store but they can't, but it is putting
then the emphasis back on them so that they manage the disk files
that they've got stored.
We've looked at login issues,
making sure that we know how the user is logging, and the
credentials that the users are using to access the system.
We've seen that maybe we've got password‑based
authentication turned off for SSH. We might have locked
accounts. We might have expired accounts.
These are all things that we can go through and check on by looking at things
like our passwd command and the status, or by going through and checking
certain configuration files like our SSH Daemon configuration file. Our
password issues, and password issues, they're the bane of our lives, however,
we've seen then how password complexity is managed. And if we can kind of
explain it a little bit to our users,
they might be then more able to manage passwords.
We can also make our passwords a little bit more simple or allow
more simple passwords through, but obviously we've got to be able to
match the security needs of the system.
If users are struggling with passwords,
then can we use key‑based authentication mechanisms instead? With file access,
it's really just checking the ID command and making sure that we've
got the right user ID and the right group IDs in the assigned
access control lists. But don't forget,
it's very easy to miss things like SELinux in the background, so go
through and make sure that if everything seems right from the file
mode and access control list, that it's not SELinux causing us
problems in the background.
So ausearch is going to be a good friend for you there.
We finished up by taking a look at sudo and some of the problems that we
might have trying to escalate our privileges, and most of what I found is
people are struggling with the environment variables and not understanding
why the environment variable works in their local shell but not when
they're using sudo. So we've seen that we have a reset of our environment
variables, but we can either pass variables through with the
preserve‑environment option, or we can configure it in the back end in our
sudo ‑S file with the env_keep. And that's it, the end of this module.
Another slap on your back and a congratulations. But we're not quite finished
yet. In our next module, and I really hope you're going to join me for this,
we're going to diagnose issues using systemd.
So hopefully some really cool things that you're going to be able to find out in our next module.