Lion Cipher Lab
Implement just-in-time (JIT) privileged access on your own Linux machine
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most breaches are not clever — they are an attacker landing on an account that already had administrator power sitting there, unused, waiting. That waiting power is called standing privilege, and it is pure attack surface: every hour an account can become root is an hour that account is worth stealing. Just-in-time (JIT) access flips the default. Instead of handing out admin rights and hoping nobody abuses them, you grant elevated access only at the moment it is needed, only for as long as it is needed, and you log the whole thing. Cloud platforms have spent years building exactly this — AWS…
What you'll learn
- least privilege in practice
- reducing standing privilege
- just-in-time (JIT) access
- time-boxed sudo grants
- sudoers drop-in files (/etc/sudoers.d)
- auto-revocation with systemd timers
- reading the sudo audit trail
- how cloud IAM does temporary access (AWS STS, Azure PIM)
Steps in this lab
- The idea: standing privilege is the attack surface
- Set up a safe throwaway box and a helper account
- Feel it first: elevation is already time-limited
- Confirm the audit trail before you rely on it
- The wrong way, so you never mistake it for the right way
- Recovery drill: how NOT to lock yourself out
- Grant JIT access: a time-boxed sudoers drop-in
- Make it expire on its own: auto-revoke with a systemd timer
- Verify the full cycle: use it, then watch it vanish
- How the cloud does JIT (read-the-docs, free)
- Why this is the whole game