In this lesson, you will learn how to identify the subtle "canaries in the coal mine" that signal your identity provider (IdP) or authentication backend has been compromised.
When we talk about monitoring identity compromise, we aren't just looking for failed passwords; we are looking for anomalous patterns that suggest an adversary has gained persistent access to your authentication layer. If an attacker breaches your central IdP, they don't always announce themselves with brute force; instead, they often attempt to "live off the land" by manipulating local PAM (Pluggable Authentication Modules) configurations or injecting unauthorized SSH keys.
Detecting Anomalous Identity Signals
To catch a compromise, you need to monitor for deviations from your established baseline. Three primary indicators should trigger immediate alerts:
- Unauthorized PAM Configuration Changes: Adversaries often modify files in
/etc/pam.d/to bypass authentication or introduce backdoors. Useauditdto watch these files:# Monitor for any write access to PAM configurations -w /etc/pam.d/ -p wa -k identity_integrity - Unexpected Credential Usage: If an account suddenly authenticates from an unusual geolocation or uses an authentication method it hasn't used in the past (e.g., a service account suddenly using SSH instead of internal API calls), this is a high-fidelity indicator of credential theft.
- Persistence through Authorized Keys: Attackers often add their public keys to
~/.ssh/authorized_keysfor long-term access. Monitoring the file modification time (mtime) on these sensitive files across your fleet is critical.
The Role of Contextual Correlation
Because identity providers are complex, individual logs rarely tell the whole story. You must correlate local logs (like auth.log or secure) with IdP-side telemetry. For instance, if an IdP indicates an account is "Locked" but your local server shows successful password authentication, you have identified a critical synchronization failure or, more likely, an attacker bypassing the IdP to authenticate directly against the local shadow file.
By monitoring the integrity of your authentication configuration and watching for logical discrepancies between your centralized IdP and your local Linux endpoints, you can detect identity compromise before it escalates into full system exfiltration.
Key Takeaway: Effective identity monitoring requires auditing critical configuration files for unauthorized changes and cross-referencing local authentication successes against centralized IdP state to spot bypass attempts.