🛡️ Linux Privilege Control & PBIS Login Authorization

📋 Overview

This document explains how to audit and differentiate between:

• Sudo Access: Who can run privileged commands via sudo.
• PBIS Login Authorization: Who is allowed to log into the system (typically via SSH) when using PowerBroker Identity Services (PBIS).

---

🔍 Section 1: Auditing Sudo Access

To identify which local or AD groups are allowed to run commands with sudo, inspect the sudoers configuration.

✅ Command:

sudo grep -E '^%.*ALL=\(ALL\)' /etc/sudoers /etc/sudoers.d/* 2>/dev/null

💡 What It Does:

• Scans sudoers files for group-based sudo access rules.
• Returns lines that match the pattern for full sudo rights (e.g., %groupname ALL=(ALL)).

🔁 Example Output:

%admin ALL=(ALL) ALL
%wheel ALL=(ALL:ALL) ALL
%domain^admins ALL=(ALL) ALL

📁 Files Scanned:

• /etc/sudoers
• /etc/sudoers.d/* (drop-in config directory)

---

🔐 Section 2: Auditing PBIS Login Authorization

When using PBIS to integrate Active Directory with Linux, login access can be restricted to members of specific AD groups.

✅ Command:

/opt/pbis/bin/config --details RequireMembershipOf

💡 What It Does:

• Shows which AD groups are required for login access.
• If a user is not a member of at least one of these groups, login will be denied — even if their AD credentials are valid.

🔁 Example Output:

RequireMembershipOf: EXAMPLE\\LinuxAdmins
RequireMembershipOf: EXAMPLE\\Domain Admins

---

🔄 Key Differences

Feature	sudoers (grep -E)	PBIS RequireMembershipOf
Controls	Who can run sudo commands	Who can log into the system
Based on	Local or AD Linux group in sudoers	Active Directory group membership
Location / Tool	/etc/sudoers, /etc/sudoers.d/*	/opt/pbis/bin/config
Applies To	Privilege escalation	Login authorization
Example	%domain^admins ALL=(ALL) ALL	RequireMembershipOf: EXAMPLE\\LinuxAdmins

---

🧪 Validation Steps

1. To test sudo access:
   • Login as a user.
   • Run sudo -l to see allowed commands.
   • Check group membership: groups <username>
2. To test login access:
   • Remove the user from all RequireMembershipOf groups.
   • Attempt SSH login — should fail with "Access denied".

---

✅ Recommendation

To maintain least privilege and security best practices:

• Restrict login using RequireMembershipOf to necessary AD groups.
• Configure sudoers to only grant elevated access to trusted groups/users.
• Regularly audit both to prevent privilege creep.