Lion Cipher Lab
Write a least-privilege sudoers policy that grants one command, not the keys
- Identity & Access Management
- Intermediate
- ~45 min
- Free · no account required
Why it matters
"Give them sudo" is the most common over-grant in the world. The moment an account can run anything as root, a stolen password, a phished session, or a careless script is a full box takeover — there is nothing left to stop. Real least privilege means an on-call engineer who needs to bounce one service and read one log gets exactly that, and every other privileged action is refused. Writing that policy correctly — and knowing the ways it silently re-widens — is a core identity-and-access skill that shows up in every audit, every incident review, and every hardening baseline.
What you'll learn
- Writing and validating a sudoers drop-in file
- Cmnd_Alias and the user/host/runas/command grammar
- Least-privilege command authorization
- Recognising sudo footguns: wildcards, unquoted arguments, and shell-escapes
- Proving an authorization boundary by testing as the target user
Steps in this lab
- The idea: authorization is a list of allowed commands, not an on/off switch
- When you reach for this — and when you do NOT
- Set up a target user and a service to practise on
- Measure the BEFORE state: oncall can do nothing (or, wrongly, everything)
- Write the drop-in with visudo — never edit sudoers by hand
- Validate before you trust it: visudo -c
- Measure the AFTER state: exactly two commands work, everything else is refused
- The footguns: how a "restricted" grant silently becomes root
- The honest limit: when this is NOT enough