I want to make sure no one has sudo access or root access on some production servers. Some points I have also verified like:

  1. grep 'x:0:' /etc/passwd
  2. grep root /etc/group
  3. cat /etc/sudoers
  4. key in /root/.ssh/authorized_keys file
  5. some check points in sshd.conf like PermitRootLogin no etc.
  6. find / -perm -04000
  7. getent passwd 0
  8. getent group root wheel adm admin

Did I forget/skip any?


The /etc/sudoers.d/ directory, because it is included in the /etc/sudoers file:

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.