It looks like it's been sorted out, but there are still some open seats.
This is usually what happens when a developer leaves the company. Suspend your company email account and receive a laptop and employee ID card. What you can see has been sorted out.
What remains is the invisible side. Access rights to servers and management screenswill not be confirmed until you create a list.
Even if you change one password, the other doors remain the same.
This is because there is more than one way to access it. Each is registered in a different way, so even if you close one, the others remain.
| door | Where is it registered? | When only mail stops |
|---|---|---|
| company mail | mail service account | closed |
| SSH public key | ~/.ssh/authorized_keys | Open as is |
| database user | mysql.user | Open as is |
| repository deployment key | Deploy key | Open as is |
Passwords are something people memorizeAnd, The public key and distribution key are registered on the machine.no see. Even if you change your password, registered lines will not be deleted. Even if you remove a collaborator from the repository, the Deploy key remains separate.
Failures appear piled up and success passes by in a single line.
This connection is less noticeable. Attempts to tap any account from outside Failed password It piles up and becomes visible immediately. On the other hand, if you enter with an already registered key, Accepted publickey It passes in one line.
The record itself remains. However, if you have set a notification based on the number of failures, this line will not be triggered. And who the key belongs to is not the log. View the list of registered keys You can tell. Rather than “an alarm will not sound even if it is breached,” it is more accurate to say “it will not be triggered by notifications that only show failure.”
There are two ways to count:
When BlueCanvas checked the existence of each item in its operating assets and counted them, the positions that could remain with access rights were divided into two. Number of digits that can be counted by command on the server four places, the place where a person has to open the console eight placesIt was.
| Places in the server that can be counted using commands | How to check |
|---|---|
| server login account | getent passwd View accounts with a login shell as |
| Registered SSH public key | ~/.ssh/authorized_keys View the lines and comments following them. |
| sudo permissions | getent group sudo and /etc/sudoers.d/ View |
| database user | SELECT user, host FROM mysql.user; View your account and access range with |
| Outside of the server · Place where you need to open the console | Why it's important |
|---|---|
| Administrator page login | If you use CMS, you can also see the administrator level in the member table. |
| FTP · SFTP account | Shared hosting may have separate FTP passwords and SSH passwords. |
| Hosting/Cloud Console | It has greater privileges than the server account as it can delete servers or create new ones. |
| domain registrar | If this is open, the address will be transferred to another place even if you lock the server. |
| Storage account and deployment key | Even if you remove a collaborator, the deployment key remains separate. |
| Backup Storage API Key | A backup is a full copy, so one key is equivalent to the entire server. |
Since the services used are different for each business, the number of positions and names will vary. This table can be viewed as a starting point when deciding “where our company should look.”
Get the list first before deleting it.
- Request a list of remaining accounts and access methods in the name of the person who left the company. Collect accounts, public keys, database users, console logins, and deployment keys in one place.
- Before deleting, check if it is an account you used together. Simply deleting the shared account may cause both deployment and backup to stop. First check to see if cron and deployment scripts are using that account.
- The key distinguishes between erasing and issuing a new one. Delete only that person's key, and create a new key that was used together and replace it. If they are discarded all at once, normal service will stop.
If you are curious about the record of the person knocking on the outside, If the administrator address is /admin, how many times will it be attacked per day?You can continue watching. You can also entrust us with organizing the list and monitoring it afterwards.
The checklist, access method table, and log that appear in the text and video are reproduction screens and do not transfer actual account names or keys.
