What is a good way to audit the user accounts on a Linux machine? I will like to have a list of users, the folders they can access and the process they are running, so I can pinpoint security risks, like a nodejs express server running as root, or nginx running a root, or folders with permissions too open.

It will be very useful especially if you do not configure the server and you will like to have a fast panoramic of what's happening. I know there no single command that can do this, but I wonder if there is a list of things to check.

  • 2
    Best bet is going to be slowly decommissioning bespoke, randomly provisioned servers and replacing them with ones set up and managed by a configuration management tool where it's not possible for someone to do things like running stuff as root that shouldn't be. – ceejayoz Nov 30 '17 at 13:43

First: before you can audit you have to establish a (base-line) security policy.

That is where you decide on a lot of (often seemingly extremely obvious) security and risk control/mitigation policies. Many will be phrased generically, regardless of OS platform, others may be concepts and settings specific to Linux, Windows, the same or different for servers and workstations.

An audit is then where you determine how the policy should be implemented at a technical level, what the desired state of a server should be and report on where reality differs from the desired state.

Once you have established your policy, creating the audit should be fairly straightforward.

I.e if your policy states that your users must change their passwords every 90 days, then your audit must check if password expiry is set for all user accounts, which you implement on Linux servers by checking if the fifth field in /etc/shadow and /etc/passwd is set to 90 or less.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.