The Rule They Left Behind
EasyLinux Security10-15 minA departing contractor left themselves a way back in. Somewhere under /etc/sudoers.d/ a drop-in grants the deploy service account passwordless root — dressed up with a comment that reads like leftover CI plumbing. Audit the sudoers policy, remove the backdoor without breaking the legitimate %wheel admin grant, and recover what they left as a receipt.
Record your findings under /root/case:
1. Remove the drop-in rule that grants deploy sudo. The legitimate %wheel ALL=(ALL) ALL rule must stay — don't nuke the whole policy.
2. The offboarding receipt is a dotfile in root's home — a plain ls won't show it. Recover the flag to /root/case/flag.txt.
See /root/case/brief.txt. Grading reads the sudoers files directly.
- Audit the layered sudoers policy (/etc/sudoers + /etc/sudoers.d/)
- Remove a passwordless-root backdoor for a service account without breaking legitimate admin access
- Recover the flag the contractor left behind
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.