HackBlue

Tools · Workbench

Linux command line for security

Tutorials on the Linux commands defenders use every day: permissions, processes, logs, journalctl, SSH hardening, cron, sudo, and file integrity.

  • 28 lessons
  • 4.5 h of reading
  • 7 topics
Start with lesson 1All workbenches

Most servers you will defend run Linux, and most of the evidence on them is a text file or a command away. These tutorials take one question at a time, such as who can read this file or what started this process, and answer it with commands you can paste into a lab VM.

Practice on a virtual machine you can snapshot and revert. Commands that change permissions or services are shown with the check that proves they worked.

Permissions and accounts

8 lessons

  1. 01Linux file permissions explained: rwx, octal chmod, and ls -lRead the ten characters at the start of ls -l, convert them to octal, and choose chmod values for scripts, keys, and shared folders.11 min
  2. 02How to find SUID and SGID files on Linux and decide which are riskyUnderstand setuid, setgid, and the sticky bit, list every SUID binary with find, and compare the list to a known-good baseline.11 min
  3. 03What umask does on Linux and how to set safer default permissionsLearn how umask subtracts bits from new files and directories, check the current value, and set 027 for service accounts and shared servers.8 min
  4. 04Linux ACLs with getfacl and setfacl: sharing a folder with one extra userUse POSIX ACLs when owner-group-other is not enough, read the plus sign in ls -l, and understand the mask that silently limits entries.9 min
  5. 05How to find world-writable files and orphaned files on LinuxUse find to list world-writable files and directories without the sticky bit, files with no owner, and decide which ones to fix.8 min
  6. 06How to configure sudo safely: visudo, sudoers.d, and least privilegeEdit sudoers without locking yourself out, grant one command instead of ALL, avoid rules that hand out a root shell, and audit who can sudo.11 min
  7. 07How to audit Linux user accounts: passwd, shadow, lastlog, and UID 0List real login accounts, find extra UID 0 users and empty passwords, review last logins, and lock accounts that no longer need access.10 min
  8. 08Linux password policy with pam_pwquality and account lockout with pam_faillockSet password length and quality rules, lock accounts after repeated failures, and unlock a user safely on modern Ubuntu and RHEL.10 min

Hardening

5 lessons

  1. 01How to set up UFW on Ubuntu without locking yourself outEnable Ubuntu’s Uncomplicated Firewall with a default-deny inbound policy, allow SSH from a management range, and verify with ss and Nmap.9 min
  2. 02SELinux vs AppArmor: what they do and how to read a denialUnderstand mandatory access control, check whether SELinux or AppArmor is enforcing, read a denial in the audit log, and fix it without disabling protection.11 min
  3. 03Automatic security updates on Ubuntu and RHEL: unattended-upgrades and dnf-automaticTurn on automatic security patching, check what was installed, handle reboots for kernel updates, and know when automation needs a human.9 min
  4. 04How to run a Lynis security audit on Linux and prioritize the resultsInstall Lynis, run a system audit, read warnings and suggestions, and turn the report into a short hardening plan instead of a long checklist.9 min
  5. 05Linux sysctl hardening: the kernel settings worth changingRead and set sysctl values for network spoofing protection, ptrace restrictions, kernel pointer hiding, and dmesg access, and persist them in sysctl.d.10 min

Processes

3 lessons

  1. 01How to investigate a suspicious process on Linux with ps, pstree, and topFind a process using too much CPU or running from an odd path, see its parent and children, its user, start time, and command line.11 min
  2. 02Which process is listening on a port? Using ss and lsof on LinuxMap every listening socket and established connection to a process and user with ss -tulpn and lsof -i, and spot services bound where they should not be.9 min
  3. 03Reading /proc for live response: exe, cmdline, environ, and deleted binariesUse /proc/PID to recover a running program whose file was deleted, read its real command line and environment, and list its open file descriptors.10 min

Logs

4 lessons

  1. 01journalctl for security: filtering by unit, time, priority, and userQuery the systemd journal for SSH logins, sudo use, service crashes, and kernel messages in a time window, and export it as JSON for analysis.10 min
  2. 02How to read auth.log and find failed SSH logins on LinuxFind failed and successful SSH logins in /var/log/auth.log or secure, count attempts by source and username, and tell guessing from a real compromise.10 min
  3. 03Getting started with auditd: watch files and commands on LinuxInstall the Linux audit daemon, add watch rules for sensitive files and execve rules for commands, and search the results with ausearch and aureport.12 min
  4. 04How to forward Linux logs to a central server with rsyslogSend auth and system logs from lab clients to a central rsyslog server over TCP with a disk queue, and verify nothing is lost when the server restarts.10 min

SSH

3 lessons

  1. 01How to harden an SSH server: the sshd_config settings that matterDisable root and password logins, limit who can connect, set modern algorithms, and test changes without locking yourself out.12 min
  2. 02How to set up SSH key authentication with ed25519 keysGenerate an ed25519 key with a passphrase, install it with ssh-copy-id, use ssh-agent, and restrict keys in authorized_keys.10 min
  3. 03How to set up Fail2ban for SSH and check that it is banningInstall Fail2ban, configure an sshd jail in jail.local, test a ban from a lab machine, and unban safely.9 min

Persistence checks

3 lessons

  1. 01How to list every cron job on a Linux system and spot malicious onesFind system and user crontabs, cron.d drop-ins, anacron, and at jobs, and recognize the patterns attackers use for persistence.10 min
  2. 02Auditing systemd services and timers for persistenceList enabled units and timers, find unit files outside package control, inspect user-level units, and read what a unit actually runs.10 min
  3. 03Linux persistence checklist: authorized_keys, shell profiles, ld.so.preload, and moreA defender’s list of the places attackers hide to survive a reboot or a password change, with one command to check each.11 min

Integrity

2 lessons

  1. 01File integrity monitoring on Linux with AIDEInstall AIDE, build a baseline database of hashes and attributes, run a check after a change, and keep the database somewhere an intruder cannot edit.10 min
  2. 02How to verify installed package files with debsums and rpm -VaCheck installed binaries and configs against package checksums to find modified system files, and read the rpm verify flags.9 min