adminLeast Privilege Access Checklist for Linux and Cloud Servers
Least privilege means users and services should only have the access they need to do their job. This reduces damage when a password, plugin, script, workflow or API key is compromised.
Core principle
Do not run everything as root. Do not give admin access to accounts, scripts or services that only need limited permissions.
Checklist
- List all human admin accounts.
- List service users.
- Check who has sudo access.
- Remove unused admin accounts.
- Use separate users for separate roles when practical.
- Restrict file ownership to required paths.
- Do not run automation scripts as root unless necessary.
- Limit database user privileges.
- Review API key permissions.
- Document why each privileged account exists.
Reusable lesson
Security is not only blocking attackers. It is limiting damage when something goes wrong.
When to Use This Checklist
Use this checklist when hardening Linux servers, WordPress VPS, Docker hosts or AI automation infrastructure.
Required Tools
SSH access, user list, sudoers, database access, API provider dashboard, file ownership map
Before You Start
Before removing access, confirm which users and services are still needed for production operations.
Structured Checklist Steps
- List human users.
- List service users.
- Check sudo access.
- Remove unused admins.
- Separate roles if needed.
- Restrict file ownership.
- Avoid root automation.
- Limit database privileges.
- Review API key scopes.
- Document privileged access.
Verification Steps
- Only trusted users have sudo.
- Unused admins are removed.
- Services have limited permissions.
- Database users are not over-privileged.
- API keys have appropriate scope.
Rollback Plan
If access removal breaks a service, restore the minimum permission required rather than returning broad root or admin access.
Common Mistakes
- Running everything as root.
- Keeping old admin accounts.
- Using one database user for everything.
- Over-scoped API keys.
- No record of privileged access.
Related Commands
cat /etc/passwd
getent group sudo
sudo -l
ls -la /var/www/
mysql -u root -p -e "SHOW GRANTS FOR 'db_user'@'localhost';"