TL;DR heinzel knows only its own sudo and misreads it, and it does not know where a host's accounts and sudo rules come from.
Where: rules/privilege-escalation.md (the sudo probe), the security audit, the fleet audit; no rule covers accounts yet.
Now: sudo -n true prints "a password is required" for three cases: NOPASSWD for some commands only, a password needed, and no sudoers entry. heinzel records the first as unusable sudo and falls back to root SSH, and it cannot detect the third. A certificate names an account, but sshd resolves the account through NSS before it checks the certificate; heinzel does not check whether accounts come from local files, a directory or an agent, whether a first login gets a home, or who gets sudo through which group. The security audit checks only empty passwords, extra UID 0 and system accounts with a shell.
Should: Record per host where accounts and sudo rules come from and which model the host uses (role account, directory, local, agent); use sudo for what it allows without a password; report account source, sudo rules by who holds them, and local accounts in the security and fleet audits.
Constraints: Read-only probes on Linux, FreeBSD and macOS. No secrets printed. heinzel never writes to a directory, IdP or CA.
An AI agent wrote this text in my name. I know that is problematic.
Part of #27.
TL;DR heinzel knows only its own sudo and misreads it, and it does not know where a host's accounts and sudo rules come from.
Where:
rules/privilege-escalation.md(the sudo probe), the security audit, the fleet audit; no rule covers accounts yet.Now:
sudo -n trueprints "a password is required" for three cases: NOPASSWD for some commands only, a password needed, and no sudoers entry. heinzel records the first as unusable sudo and falls back to root SSH, and it cannot detect the third. A certificate names an account, but sshd resolves the account through NSS before it checks the certificate; heinzel does not check whether accounts come from local files, a directory or an agent, whether a first login gets a home, or who gets sudo through which group. The security audit checks only empty passwords, extra UID 0 and system accounts with a shell.Should: Record per host where accounts and sudo rules come from and which model the host uses (role account, directory, local, agent); use sudo for what it allows without a password; report account source, sudo rules by who holds them, and local accounts in the security and fleet audits.
Constraints: Read-only probes on Linux, FreeBSD and macOS. No secrets printed. heinzel never writes to a directory, IdP or CA.
An AI agent wrote this text in my name. I know that is problematic.
Part of #27.