Remove the previous team's access inside the product

How to do it

Take control of every account before touching the code secures the vendor accounts, and Rotate every secret the previous team could read replaces shared secrets. A former developer may still hold an admin user in the app, a key in authorized_keys or a personal API token. A webhook or an OAuth app can keep sending data to an address the old team controls. Query the users table for admin roles, and read authorized_keys for every user on every server. List the deploy keys, installed apps and webhooks in the code host and in each vendor. Remove what has no current owner, and record the rest with its owner in the system map.

Examples

Shell example

# Every key that can sign in to each server, with its comment
for host in app1.example.com app2.example.com; do
  ssh "$host" 'sudo sh -c "cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/null"' | awk -v h="$host" '{ print h, $NF }'
done
# Deploy keys and webhooks on the repository
gh api repos/example/shop/keys --jq '.[] | [.id, .title, .created_at] | @tsv'
gh api repos/example/shop/hooks --jq '.[] | [.id, .config.url] | @tsv'

SQL example

-- Admin users in the app, oldest sign-in first
SELECT email, role, last_sign_in_at FROM users WHERE role IN ('admin', 'owner') ORDER BY last_sign_in_at;

How to check

The access list names every admin user, SSH key, deploy key, API token, OAuth app and webhook, each with a current owner. A fresh query of admin users and a scan of every authorized_keys file find no entry missing from the list.

Sources

• NIST SP 800-53 Rev. 5, AC-2 Account Management

Related rules

• TKO-1 Take control of every account before touching the code in Codebase takeover
• TKO-2 Rotate every secret the previous team could read in Codebase takeover
• TKO-5 Map the system before changing it in Codebase takeover