Linux AAA

Authentication

What it means:
Authentication verifies who the user is.

How it works in Linux:

• When you log in, Linux checks your credentials (usually username + password) against /etc/passwd and /etc/shadow.

• /etc/passwd stores user information (username, UID, GID, shell, home directory).

• /etc/shadow stores hashed passwords and password expiration info, readable only by root.

Common authentication methods:

• Local authentication: Using /etc/passwd and /etc/shadow.

• Remote authentication: Using services like:

  • LDAP (Lightweight Directory Access Protocol) – centralized user management.

  • Kerberos – provides secure, ticket-based authentication.

  • RADIUS – used in network access (VPNs, Wi-Fi, etc.).

  • PAM (Pluggable Authentication Modules) – modular framework used by Linux for integrating different authentication methods.

Example PAM file location:
/etc/pam.d/
Each service (like SSH, sudo, login) has its own PAM configuration file.

Authorization

What it means:
Authorization determines what an authenticated user is allowed to do.

How it works in Linux:

• Linux controls access to files and system resources through permissions, ownership, and access control mechanisms.

Core methods:

• File Permissions (rwx):
  Each file and directory has:

  • Owner permissions

  • Group permissions

  • Others permissions

  Example:
  -rw-r--r-- 1 ozz961 users 1234 Oct 29 file.txt

• Sudo / Polkit (PolicyKit):

  • sudo lets specific users execute commands as root.

  • Controlled by /etc/sudoers.

  • Example rule:

    ozz961 ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart apache2
    

  • Polkit provides fine-grained access control for desktop and system-wide services (D-Bus based).

• SELinux / AppArmor:

• SELinux (Security-Enhanced Linux) enforces mandatory access control (MAC).

• Defines what processes can do, even if they run as root.

• AppArmor works similarly, using profile-based restrictions.

Accounting

What it means:
Accounting tracks what users do — actions, commands, system access, and resource usage.

How it works in Linux:

• Shell History: Basic command tracking (~/.bash_history).

• Process accounting: Tracks system resource usage (CPU time, memory, etc.) per process or user.

  • Tools: acct, sa, lastcomm

• Auditd (Linux Auditing System):

  • Logs all system events and security-relevant actions.

  • Configuration: /etc/audit/auditd.conf

  • Example rule:

    auditctl -w /etc/passwd -p wa -k passwd_changes
    

    → Watches for writes/attribute changes to /etc/passwd and tags logs with key passwd_changes.

• Syslog / journald: System-wide logging of authentication attempts, command execution, service logs, etc.

  • Files like /var/log/auth.log or /var/log/secure.

Demo

In this demo i am going to illustrate how in practice a Linux system would apply AAA on the users. 

In the picture above, it's showing Authorization access control, as we weren't allowed to access the shadow file without sudo permissions. 

We can also be denied access to a directory, where we can also see each directory permissions is associated to a user. 

When a directory permissions is being altered by a malicious actor, the sort of permissions that is being is the least of their concern. However, the implemented access control has stopped us from changing the permissions of other users, even if that meant to be higher than our current user. 

All processes regarding authorization and authentication are being logged in details, and this is where we end our demo with accounting. The /var/log directory is the standard logging directory of the linux system. 

The AAA logs can be seen in /var/log/auth.log. It provides us with time, commands, permission logs, directory, type of user...etc on each execution being processed on the host system.