Linux Authentication

User Account/Data

• /home/%username%/* • /etc/passwd
• /etc/shadow
• /etc/sudoers

• /etc/group

Unused accounts

Look for unexpected account, especially those that don’t have password (empty).

cat /etc/shadow | awk -F: '($2==""){print $1}' # 

Effective ID vs Real ID

References

1

eForensics Magazine, Linux Forensics and Security