linuxexpert-practice-labs/labs/ex294/3-3-privilege-escalation/README.md

EX294 3.3: Privilege escalation

Give the automation user passwordless sudo with a validated sudoers drop-in, see validate stop a broken one, and run one task as another user in a play that becomes root.

Before you start

This VM is the control node. The lab creates the user greg (password Lab-Pass-1) with an SSH key, and installs ansible-core and sshpass. Work as greg, in /home/greg/ansible: its ansible.cfg reads the inventory inventory, logs in as devops and has become = true.

The managed nodes node1 (10.99.1.11) and node2 (10.99.1.12) are AlmaLinux 10 containers reached over SSH by name. On each, devops accepts greg's key but has no sudo rights yet, so ansible all -a id fails for now. root and ansible (in wheel, so sudo asks for the password) have the password Lab-Pass-1, as does devops. For a root shell on a node, sudo podman exec -it node1 bash.

Tasks

1. Write /home/greg/ansible/sudo.yml, which gives devops passwordless sudo on every managed node with a validated drop-in, /etc/sudoers.d/devops, mode 0440, and run it. Then ansible all -a id shows uid=0(root) on every node.
2. Copy it to /home/greg/ansible/typo.yml and put a typo in the rule (for example, leave out the colon after NOPASSWD). Running typo.yml must fail at validate, and sudo must still work on the nodes.
3. Write /home/greg/ansible/whoami.yml: a play with become: true whose command: whoami task has become_user: devops and prints devops for every node.

Hints

• Until devops has sudo, log in as someone who has it: remote_user: root with -k, or remote_user: ansible with -k -K.
• ansible.builtin.copy with content, mode: "0440" and validate: /usr/sbin/visudo -cf %s; the rule needs its trailing newline.
• register the result and print .stdout with debug, or run the playbook with -v.