Lion Cipher Lab
Audit and clean up the user accounts on your own Linux machine
- Identity & Access Management
- Beginner
- ~45-60 min
- Free · no account required
Why it matters
Every computer, server, and cloud system is used through 'accounts' -- named identities that log in and are allowed to do certain things. In any organization, keeping that set of accounts clean is one of the most important and least glamorous jobs in security, and it has a name: identity and access management (IAM). The reason it matters is blunt: attackers do not usually 'hack in' through some cinematic exploit -- far more often they log in, using an account that should not have existed, should have been disabled when someone left, or had far more power than the job needed. A former…
What you'll learn
- what a 'user account' actually is on a Linux system
- reading /etc/passwd and enumerating every account with getent
- telling human accounts from service/system accounts (login shell and UID)
- finding which accounts can actually log in vs which are blocked
- finding which accounts hold sudo (administrator) power
- spotting stale accounts with last, lastlog, and chage
- the joiners-movers-leavers (JML) identity lifecycle in plain terms
- least privilege as an operating rule, not a slogan
- safely disabling an unused account (locking, not deleting)
- reviewing and trimming sudo so power matches need
Steps in this lab
- What a 'user account' is, and why cleaning them up is a real job
- Get a free Linux environment to practice on (from nothing)
- Open a terminal and list every account on the machine
- Which accounts can actually log in? (people vs services)
- Which accounts hold admin power? (finding sudo)
- Find the stale accounts: who hasn't logged in?
- The framework behind all of this: joiners-movers-leavers and least privilege
- Take action: disable an unused account (lock, don't delete)
- Review sudo: take back admin power that isn't needed
- Make it a habit, and where to take this next