Cheat sheet
Linux essentials
The locations, logs and commands to know to administer, investigate or respond to an incident on a Linux machine.
CJCADefence
Key files and folders
| Path | Content |
|---|---|
| /etc/passwd | User accounts (without passwords) |
| /etc/shadow | Password hashes, readable by root only |
| /etc/group | Groups and their members |
| /etc/sudoers | sudo rights (edit with visudo) |
| /etc/crontab, /etc/cron.* | System scheduled tasks |
| /etc/systemd/system | systemd services and timers |
| /etc/hosts | Local name resolution |
| ~/.ssh/authorized_keys | Public keys allowed to log in |
| ~/.bash_history | The user's command history |
| /tmp, /dev/shm | World-writable temporary folders |
| /proc | Information about running processes |
Logs
| Log | Content |
|---|---|
| /var/log/auth.log | Authentication, sudo, SSH (Debian, Ubuntu) |
| /var/log/secure | Equivalent on RHEL, CentOS, Fedora |
| /var/log/syslog | General system log (Debian, Ubuntu) |
| /var/log/messages | General log (RHEL and derivatives) |
| /var/log/wtmp | Logon history (read with last) |
| /var/log/btmp | Failed logons (read with lastb) |
| /var/log/audit/audit.log | auditd events |
| journalctl | The systemd journal |
Permissions
| Notation | Meaning |
|---|---|
| r / w / x | Read (4) / write (2) / execute (1) |
| 755 | rwxr-xr-x: everything for the owner, read and execute for others |
| 644 | rw-r--r--: a regular file |
| 600 | rw-------: owner only (private keys) |
| SUID (4000) | The program runs with its owner's rights |
| SGID (2000) | Runs with the group's rights; group inheritance on a folder |
| Sticky bit (1000) | In a folder, only the owner can delete their files (/tmp) |
Investigation commands
# Who is logged in, who has logged in w ; last -a | head ; lastb | head # Processes and tree ps auxf # Network connections and listening ports ss -tulpn # Scheduled tasks of every user ls -la /etc/cron.* ; for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u "$u" 2>/dev/null; done # Active services and timers systemctl list-units --type=service --state=running ; systemctl list-timers # Files modified in the last 24 hours find / -xdev -mtime -1 -type f 2>/dev/null # SSH journal since yesterday journalctl -u ssh --since yesterday