Remove standing privilege and measure what is left

applied · 80 min · Objective 4.6

Task

Convert an always-on administrator into just-in-time elevation, then measure what an attacker compromising the everyday account would now obtain. The value of JIT is a number, and this lab produces it.

Steps

  1. Start from the standing-privilege state: a user with unrestricted sudo. Record what that account can do — read any file, change any service, view any log — into /tmp/standing.txt by testing rather than asserting.
  2. Now remove the standing rights and build the elevation path: a separate administrative account the everyday user can assume only through an auditable step, with a time limit.
  3. Implement the time limit honestly: a sudo timestamp timeout, a group membership added by a script and removed by a timer, or a certificate issued for a short validity as in the previous lab.
  4. Add the audit trail: every elevation is logged with who, when, and why. The reason field is not decoration — it is what makes a review possible.
  5. Re-run the same capability tests as the everyday user and write /tmp/afterjit.txt.
  6. Compare the two and write /tmp/jit.md: what an attacker who compromised this account gets now versus before, how long the elevation window is, and what they would have to do to catch one.

Verify

sudo -l -U labuser 2>/dev/null | grep -c "ALL"
python3 - <<'PY'
def caps(p):
    return {l.strip() for l in open(p) if l.strip().endswith('ALLOWED')}
b,a=caps('/tmp/standing.txt'),caps('/tmp/afterjit.txt')
print('capabilities with standing privilege: %d | after JIT: %d' % (len(b),len(a)))
assert len(a)<len(b), 'the everyday account kept the same capabilities'
print('removed:',sorted(b-a)[:5])
PY
sudo grep -c "elevation" /var/log/auth.log
grep -ciE "window|attacker|reason" /tmp/jit.md

The assertion requires the everyday account to have genuinely lost capabilities. The auth.log count must be non-zero — the elevations are recorded, and an elevation path with no audit trail is just a slower way to be an administrator.

Notes

The window is the residual risk and it is worth stating precisely. JIT does not make privilege unstealable; it makes it available for a few minutes at a time, which turns an attacker's problem from 'steal a credential' into 'be present during an elevation'. That is a much harder problem, and it is the entire argument.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.