linux Linux Master Checklist

# Quick system fingerprint
hostnamectl
cat /etc/issue
who -a
last -a | head -20        # recent logins — spot suspicious login history early

# CIS Benchmark — Filesystem Configuration: check partition layout
# CIS calls for separate partitions for /tmp, /var, /var/log, /var/log/audit, and /home
# where feasible — competition images rarely have this, so it's usually informational only,
# but worth knowing before you start remounting things in Section 18.
mount | column -t
lsblk

df -h

# Fallback if lsb_release isn't installed (common on minimal RHEL/CentOS images) — /etc/os-release
# is present on virtually every modern distro and is the more portable source of truth anyway
cat /etc/*-release 2>/dev/null

# Edge case: confirm the system clock/timezone is correct BEFORE you start relying on log timestamps
# for forensics answers or an audit trail — a wrong clock makes "when did X happen" unanswerable
timedatectl 2>/dev/null || date

# Verification: sanity-check hostname and network identity match what the README describes
# (a swapped hostname is sometimes itself part of a scenario's forensics questions)
hostname; hostname -I 2>/dev/null

# Hash a specific file for a forensics answer
md5sum /path/to/file
sha256sum /path/to/file

# Find files modified/accessed in a time window (useful for "when was X placed")
sudo find / -xdev -newermt "2026-08-01" -type f 2>/dev/null

# Metadata on a file (owner, timestamps, permissions) without altering it
stat /path/to/file

# Identify file type regardless of extension (common forensics trick: renamed files)
file /path/to/suspicious_file

# Extract readable text from a binary or otherwise unreadable file — useful when a forensics
# question asks you to find a flag/string buried inside a non-text file
strings /path/to/file | less

# Build a quick timeline of recently changed files across the whole system, sorted oldest to newest —
# faster than repeated `find -newermt` guesses when you don't know the exact time window
sudo find / -xdev -type f -printf '%T@ %p\n' 2>/dev/null | sort -n | tail -50

# Edge case: an attacker-renamed file often keeps its original extension pattern in its magic bytes
# even if the filename was changed — `file` output plus `strings` together usually beats guessing
# from the filename alone.

# Base64 decode / encode
echo "SGVsbG8gV29ybGQh" | base64 -d
echo "plain text here" | base64

# Hex decode
echo "48656c6c6f20576f726c6421" | xxd -r -p
# or, if xxd isn't installed:
echo "48656c6c6f20576f726c6421" | python3 -c "import sys; print(bytes.fromhex(sys.stdin.read().strip()).decode())"

# ROT13 decode (self-inverse — same command re-encodes)
echo "Uryyb Jbeyq" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

# URL decode
python3 -c "import urllib.parse,sys; print(urllib.parse.unquote(sys.argv[1]))" "Hello%20World%21"

# Binary decode (space-separated 8-bit groups)
echo "01001000 01100101 01101100 01101100 01101111" | python3 -c "import sys; print(''.join(chr(int(b,2)) for b in sys.stdin.read().split()))"

# Find accounts with empty password fields ("::") in /etc/shadow — critical
sudo awk -F: '($2 == "" ) {print $1}' /etc/shadow

# Find accounts with locked (!) or disabled (*) passwords — verify these are intentional
sudo awk -F: '($2 == "!" || $2 == "*") {print $1}' /etc/shadow

# Alternate one-liner for empty-password accounts directly on /etc/passwd (older systems)
mawk -F: '$2 == ""' /etc/passwd

# Verify only root owns/can write /etc/passwd and /etc/shadow
ls -l /etc/passwd /etc/shadow
# Expect: -rw-r--r-- root root  (passwd)   and   -rw-r----- root shadow (shadow)

# Check /etc/securetty to control which ttys root may log in from
cat /etc/securetty

# Set home directory permissions for standard users (deny other users from browsing each other's homes)
for i in $(awk -F: '$3 > 999 && $3 < 65534 {print $1}' /etc/passwd); do
  [ -d /home/${i} ] && sudo chmod -R 750 /home/${i}
done

# List every account and last password change date
sudo chage -l <username>

# CIS Benchmark — Access, Authentication and Authorization: ensure no duplicate UIDs, GIDs, usernames, or group names
awk -F: '{print $3}' /etc/passwd | sort | uniq -d          # duplicate UIDs
awk -F: '{print $1}' /etc/passwd | sort | uniq -d          # duplicate usernames
awk -F: '{print $3}' /etc/group  | sort | uniq -d          # duplicate GIDs

# CIS — ensure the "shadow" group is empty (no user should be directly assigned to it)
awk -F: '($1=="shadow") {print $4}' /etc/group

# CIS — ensure root is the only UID 0 account AND ensure root's PATH integrity (no writable/world dirs, no "." in PATH)
sudo -u root env | grep '^PATH='

# CIS — ensure all users' home directories actually exist and are owned by that user
while IFS=: read -r user _ uid gid _ home _; do
  [ "$uid" -ge 1000 ] && [ ! -d "$home" ] && echo "Missing home dir: $user -> $home"
done < /etc/passwd

# CIS — ensure local interactive user home directories are mode 750 or more restrictive (mirrors the chmod loop above)

# Verification: confirm a lock actually took effect (look for "L" or "!" in the password-status field)
sudo passwd -S <username>
# P = usable password, L = locked, NP = no password set

# Verification: confirm a removed sudo/wheel membership actually took — re-run the group check
# after the change instead of assuming the deluser/gpasswd command succeeded
getent group sudo; getent group wheel

# Edge case: environments joined to LDAP/NIS/AD won't show all accounts in /etc/passwd — if the
# README mentions a directory service, check the broader account source too, not just local files
getent passwd | wc -l          # compare this count against `wc -l /etc/passwd` — a big gap means
                                # accounts are coming from somewhere other than local files
cat /etc/nsswitch.conf | grep ^passwd

# Edge case: an attacker-added account sometimes hides in the SYSTEM UID range (1-999) rather than
# the normal human range, banking on you only checking UID 1000+ — skim the low range too, especially
# any entry with a real login shell instead of nologin/false
awk -F: '$3 < 1000 && $7 !~ /nologin|false/ {print}' /etc/passwd

# View current failed-login lockout state for a user
sudo faillock --user <username>
sudo pam_tally2 --user <username>          # older systems

# Reset a legitimately locked-out authorized user
sudo faillock --user <username> --reset
sudo pam_tally2 --user <username> --reset  # older systems

# Quick sanity check that pwquality is actually loaded
sudo cat /etc/pam.d/common-password | grep pwquality
sudo cat /etc/security/pwquality.conf

# CIS Benchmark — Access, Authentication and Authorization: ensure default user umask is 027 or more restrictive
grep -r "^UMASK" /etc/login.defs
grep -rn "umask" /etc/profile /etc/bash.bashrc /etc/pam.d/postlogin 2>/dev/null

# CIS Benchmark — Access Control (5.4): ensure idle interactive shell sessions auto-logout via TMOUT
# Without this, someone can walk away from an unlocked, unattended root/admin shell indefinitely.
echo 'TMOUT=900' | sudo tee /etc/profile.d/99-tmout.sh
echo 'readonly TMOUT' | sudo tee -a /etc/profile.d/99-tmout.sh
sudo chmod +x /etc/profile.d/99-tmout.sh

# CIS — ensure inactive password lock is 30 days or less (disables accounts whose password has expired and gone unused)
sudo useradd -D | grep INACTIVE
sudo useradd -D -f 30

# CIS — ensure all users' last password change date is in the past (flags clock-skew / manually-edited shadow entries)
sudo awk -F: '{print $1, $3}' /etc/shadow

# CIS — ensure default group for the root account is GID 0
grep "^root:" /etc/passwd

# Verification: confirm pwquality is actually being enforced, not just installed — try setting an
# obviously weak password for a throwaway/test account and confirm PAM rejects it
sudo useradd -m testuser123 2>/dev/null
sudo passwd testuser123   # try "password" or "12345" — should be REJECTED if pwquality is working
sudo userdel -r testuser123 2>/dev/null   # clean up the test account afterward

# Fallback: on distros where /etc/pam.d/common-password doesn't exist (RHEL/Fedora/CentOS use
# /etc/pam.d/system-auth and /etc/pam.d/password-auth instead), authselect/authconfig manages these
# files — editing them by hand can get silently overwritten if authselect regenerates its profile
sudo authselect current 2>/dev/null   # shows whether authselect is managing these files on this box

# One-shot audit of the most commonly graded directives
sudo grep -E "PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords|Protocol|X11Forwarding|MaxAuthTries" /etc/ssh/sshd_config

# Restrict SSH source IPs at the firewall layer if the scenario specifies a management subnet
sudo ufw allow from 203.0.113.0/29 to any port 22

# Check for a second/rogue sshd config or an sshd listening on a non-standard port
sudo ss -tulpn | grep ssh
ls -la /etc/ssh/sshd_config.d/ 2>/dev/null

# CIS Benchmark — SSH Server Configuration: permissions on sshd_config itself and host key files
sudo ls -l /etc/ssh/sshd_config
sudo chmod 600 /etc/ssh/sshd_config
sudo ls -l /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub 2>/dev/null
# private keys should be 600 (root-owned), public keys 644

# CIS — additional SSH directives worth setting alongside the ones above
sudo sed -i 's/^#\?LogLevel.*/LogLevel VERBOSE/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?HostbasedAuthentication.*/HostbasedAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?AllowTcpForwarding.*/AllowTcpForwarding no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?MaxStartups.*/MaxStartups 10:30:60/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?MaxSessions.*/MaxSessions 4/' /etc/ssh/sshd_config

# Verification: don't just grep the config file — ask sshd itself what it will ACTUALLY apply.
# sshd -T dumps the fully-resolved effective config, which catches cases where a later line, an
# Include file, or a Match block silently overrides something you set above.
sudo sshd -T | grep -iE "permitrootlogin|passwordauthentication|permitemptypasswords|x11forwarding"

# Edge case: modern OpenSSH (7.4+) supports drop-in config snippets that are read AFTER the main
# file and can override it — if one exists and you didn't edit it too, your fix may be getting undone
ls -la /etc/ssh/sshd_config.d/ 2>/dev/null
grep -rn "PermitRootLogin\|PasswordAuthentication" /etc/ssh/sshd_config.d/ 2>/dev/null

# Fallback for older sysvinit-based systems without systemctl:
sudo service ssh restart 2>/dev/null || sudo /etc/init.d/ssh restart 2>/dev/null

# CIS — three more sshd_config directives worth setting alongside everything above:
sudo sed -i 's/^#\?DisableForwarding.*/DisableForwarding yes/' /etc/ssh/sshd_config      # one setting that blocks TCP/X11/agent/StreamLocal forwarding all at once
sudo sed -i 's/^#\?PermitUserEnvironment.*/PermitUserEnvironment no/' /etc/ssh/sshd_config  # blocks a user-supplied ~/.ssh/environment from injecting variables like LD_PRELOAD
sudo sed -i 's/^#\?UsePAM.*/UsePAM yes/' /etc/ssh/sshd_config                            # note this one should be YES, not no — it's what makes your PAM password/lockout policy actually apply to SSH logins
sudo sed -i 's/^#\?Banner.*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp          # only if SSH is required
sudo ufw enable
sudo ufw status verbose

sudo systemctl enable --now firewalld
sudo firewall-cmd --set-default-zone=drop
sudo firewall-cmd --permanent --add-service=ssh   # only if required
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# Confirm ufw survives reboot
sudo systemctl is-enabled ufw

# Inspect raw iptables rules underneath ufw/firewalld (useful for verifying no rogue rules exist)
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v

# fail2ban complements the firewall by dynamically banning brute-force IPs
sudo apt install fail2ban -y                 # Debian/Ubuntu
sudo dnf install fail2ban -y                 # Fedora/RHEL
sudo systemctl enable --now fail2ban

# Delete a specific ufw rule by number if you over-allowed something
sudo ufw status numbered
sudo ufw delete <number>

# CIS Benchmark — Network: ensure only ONE firewall utility is actively managing rules
# Running ufw and firewalld (or raw iptables rules alongside ufw) simultaneously is itself a
# CIS finding — conflicting rule sets are hard to reason about and can silently disable each other.
dpkg -l | grep -E "ufw|firewalld"        # Debian/Ubuntu — should typically show only one active
systemctl is-active ufw firewalld 2>/dev/null

# CIS — ensure loopback traffic is explicitly configured (accept on lo, drop any external traffic claiming to be from 127.0.0.0/8)
sudo iptables -L INPUT -v -n | grep lo

# Verification: don't just trust `ufw status` — confirm the rules are actually being enforced by
# testing from the host itself (a closed port should refuse/timeout, an allowed one should connect)
nc -zv -w2 localhost 22        # should succeed if SSH is allowed
nc -zv -w2 localhost 23        # should fail/refuse if telnet is (correctly) not allowed

# Fallback if ufw itself won't enable (rare, but happens in some nested-virtualization/container
# environments where the kernel netfilter modules aren't fully available) — drop to raw iptables
sudo iptables -P INPUT DROP
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # only if SSH required
sudo netfilter-persistent save 2>/dev/null || sudo iptables-save | sudo tee /etc/iptables/rules.v4

# Edge case: `ufw enable` can silently fail to persist across reboot if the ufw service itself isn't
# enabled at the systemd level — the rule check above (systemctl is-enabled) catches this, but if
# you do end up rebooting mid-round, re-check ufw status immediately after it comes back up

# Disable avahi (mDNS) and cups (printing) if not required — common easy points
sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now cups

# Trace a listening port back to the exact binary
sudo lsof -i :<port>
sudo ss -tulpn | grep <port>
readlink -f /proc/<pid>/exe

# systemd security exposure scoring — flags weakly-sandboxed units
systemd-analyze security

# Enumerate systemd sockets (can auto-launch shells on connect — rootkit favorite)
systemctl list-sockets --all

# Check for legacy /etc/rc.local bootup backdoors
cat /etc/rc.local 2>/dev/null

# CIS Benchmark — Services: named list of servers CIS says to disable unless explicitly required
# (autofs, avahi, cups, dhcp, dns/bind, ftp/vsftpd, nfs, rpcbind, rsync, samba, snmp, telnet, tftp, X11, X font server)
for svc in autofs avahi-daemon cups isc-dhcp-server bind9 named vsftpd nfs-server rpcbind rsync smbd snmpd telnet tftpd xinetd; do
  systemctl is-enabled "$svc" 2>/dev/null | grep -q enabled && echo "ENABLED (check against README): $svc"
done

# CIS — ensure mail transfer agent is configured for local-only mail delivery (not accepting remote connections)
# unless the scenario explicitly requires a mail server
sudo ss -lnt | grep -E ':25\b'

bash --version

env x='() { :;}; echo vulnerable' bash -c "echo test"

sudo apt update && sudo apt install --only-upgrade bash    # Debian/Ubuntu
sudo yum update bash                                        # RHEL/CentOS

# List packages with available security updates specifically (Debian/Ubuntu)
apt list --upgradable

# Check for held/pinned packages that silently block updates
apt-mark showhold

# See what would change before committing (dry run)
sudo apt upgrade -s

# RHEL/CentOS/Fedora: list only security-relevant updates
sudo dnf updateinfo list security
sudo yum --security check-update

# CIS Benchmark — Package Management: confirm package signature verification is actually enforced
# (a repo with GPG checking disabled lets an attacker's tampered package install silently)
grep -r "^gpgcheck" /etc/yum.repos.d/*.repo 2>/dev/null          # RHEL/Fedora — expect gpgcheck=1
apt-cache policy 2>/dev/null | grep -i "500\|https\?://"          # sanity-check configured repos are legitimate

# CIS — remove orphaned/leftover packages nothing else depends on
sudo apt autoremove -y                                            # Debian/Ubuntu
sudo dnf autoremove -y                                            # Fedora/RHEL 8+
sudo package-cleanup --leaves 2>/dev/null                          # RHEL 7 (needs yum-utils)

# ClamTK — GUI frontend for ClamAV; scoring engines sometimes check for the GUI tool specifically
sudo apt install clamtk -y
# Usage: launch it from the applications menu (or `clamtk` from a terminal), go to the
# "Scan a directory" button on the Home tab, point it at /home (or / for a full scan),
# and let it run. Check "History" afterward to review/clean anything it flagged.
# One competitor's field note: ClamTK being *installed* has sometimes scored points on its own
# even when the CLI clamscan didn't — install it in addition to the CLI tool, not instead of it.

# Full-disk clamscan with logging (slow — run in background, check back later)
sudo clamscan -r / --exclude-dir="^/sys|^/proc" -l /root/clamscan.log &

# Update rkhunter's file property database AFTER you've hardened the system (so future checks baseline against your secured state)
sudo rkhunter --propupd

# CIS Benchmark — System Maintenance / Integrity Checking: AIDE (Advanced Intrusion Detection Environment)
# is the file-integrity tool CIS actually names (rkhunter/chkrootkit/ClamAV are good practice but aren't
# the specific CIS-listed control) — install and initialize it if time allows:
sudo apt install aide aide-common -y      # Debian/Ubuntu/Mint
sudo dnf install aide -y                  # Fedora/RHEL
sudo aideinit                             # or: sudo aide --init  (builds the initial file database)

# Broaden the media search to the whole filesystem (slower, but catches files hidden outside /home)
sudo find / -xdev -type f \( -iname "*.mp3" -o -iname "*.mp4" -o -iname "*.avi" \) 2>/dev/null

# Catch renamed/extension-less contraband by content type, not filename
sudo find /home -type f -exec file {} \; | grep -iE "audio|video"

# List all installed packages sorted by install date (spot recently-added unauthorized tools fast)
grep " install " /var/log/dpkg.log | sort               # Debian/Ubuntu (log-based)
rpm -qa --last | head -30                                 # RHEL/Fedora

# Confirm Firefox is the default browser and check its security settings if the scenario mentions it
xdg-settings get default-web-browser

# Diff current SUID list against a saved baseline from earlier in the competition
sudo find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null | sort > /root/suid_now.txt
diff /root/suid_baseline.txt /root/suid_now.txt

# Find files/directories writable by "others" that also have SUID/SGID (very high risk combo)
sudo find / -xdev -type f -perm -4002 2>/dev/null

# Directory-specific perms called out in reference material
ls -ld /tmp /var/tmp /boot/grub /boot/grub2
# /tmp, /var/tmp: expect world-writable WITH sticky bit (drwxrwxrwt)
# /boot/grub(2): expect root read/write only

# CIS Benchmark — System File Permissions: check the backup copies too, not just the live files
# (/etc/passwd-, /etc/shadow-, /etc/group-, /etc/gshadow- are created automatically by useradd/passwd
# and are frequently forgotten, but CIS checks them with the same expected permissions as the live file)
ls -l /etc/passwd- /etc/shadow- /etc/group- /etc/gshadow- 2>/dev/null

# CIS — permissions on cron directories/files (root-only)
ls -ld /etc/crontab /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.d
sudo chmod og-rwx /etc/crontab /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.d

# CIS — GRUB bootloader config should not be world-readable (may contain recovery-mode boot params)
ls -l /boot/grub/grub.cfg /boot/grub2/grub.cfg 2>/dev/null
sudo chmod og-rwx /boot/grub/grub.cfg 2>/dev/null
sudo chmod og-rwx /boot/grub2/grub.cfg 2>/dev/null

# Grep every cron location at once for suspicious keywords (reverse shells, curl|bash, base64)
sudo grep -RniE "curl|wget|base64|/dev/tcp|nc -e|bash -i" /etc/cron* /var/spool/cron* 2>/dev/null

# Check for at-jobs too (cron's lesser-known cousin)
atq
sudo at -l

# CIS Benchmark — System Maintenance: cron/at should be restricted via allow-lists, not left open to everyone
ls -la /etc/cron.allow /etc/at.allow /etc/cron.deny /etc/at.deny 2>/dev/null
# CIS expects cron.allow/at.allow to exist (root-owned, 640 or more restrictive) and cron.deny/at.deny to NOT exist
sudo rm -f /etc/cron.deny /etc/at.deny
echo root | sudo tee /etc/cron.allow /etc/at.allow
sudo chmod 640 /etc/cron.allow /etc/at.allow

# Restrict search to a single mount without -xdev by specifying the path (faster on multi-disk images)
sudo find /home -type f -perm -0002 -ls 2>/dev/null

# Re-apply the sticky bit to shared temp directories instead of removing write access outright
sudo chmod +t /tmp /var/tmp /dev/shm

# Search running process environments for leaked plaintext credentials
sudo strings /proc/*/environ 2>/dev/null | grep -iE "pass|pwd|secret"

# Look for PATH hijacks specifically (e.g., a writable dir prepended before /usr/bin)
echo $PATH
for u in /home/*; do sudo -u "$(basename $u)" bash -c 'echo $PATH' 2>/dev/null; done

# Audit PAM config for injected .so files that don't live in the real security library dir
grep -r "so" /etc/pam.d/ | grep -v "/lib/" | grep -v "/usr/lib/"
ls -la /lib/x86_64-linux-gnu/security/ 2>/dev/null

# Quick summary of failed vs. accepted SSH logins
sudo grep -c "Failed password" /var/log/auth.log
sudo grep -c "Accepted password\|Accepted publickey" /var/log/auth.log

# journalctl equivalents work across both families when logs are systemd-journal-based
journalctl -u ssh --since "1 hour ago"
journalctl -p err -b

# Check who has run sudo recently
sudo grep "sudo:" /var/log/auth.log | tail -30

# CIS Benchmark — Logging and Auditing: specific auditd watch rules CIS names explicitly
# (time changes, identity/user-group changes, network config changes, login/logout events,
# discretionary access control / permission changes, sudoers changes, kernel module load/unload)
cat << 'EOF' | sudo tee -a /etc/audit/rules.d/cis.rules
-w /etc/localtime -p wa -k time-change
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
-w /var/log/lastlog -p wa -k logins
-w /etc/hosts -p wa -k network-config
-w /etc/network/ -p wa -k network-config
EOF
sudo augenrules --load 2>/dev/null || sudo service auditd restart

# CIS — ensure log rotation is configured (prevents disk exhaustion, keeps history around long enough to review)
cat /etc/logrotate.conf | grep -E "weekly|rotate|compress"

# Confirm the unattended-upgrades service/timer is actually active, not just installed
systemctl status unattended-upgrades.service
systemctl status dnf-automatic.timer

# Force a dry-run to confirm it will actually pull updates
sudo unattended-upgrade --dry-run -d

# Restrict kernel module loading entirely once you're done needing to load new ones (irreversible until reboot)
sudo sysctl -w kernel.modules_disabled=1

# List currently loaded modules to eyeball anything unfamiliar before locking module loading
lsmod

# Verify each sysctl value actually took effect
sudo sysctl kernel.yama.ptrace_scope kernel.kptr_restrict fs.suid_dumpable net.ipv4.ip_forward

# CIS Benchmark — Level 2: disable Bluetooth and wireless interfaces if the scenario doesn't need them
# (physical/RF attack surface CIS calls out separately from the network-stack sysctls above)
sudo systemctl disable --now bluetooth 2>/dev/null
rfkill list 2>/dev/null
sudo apt purge -y bluez -y 2>/dev/null      # Debian/Ubuntu — only if Bluetooth is confirmed unneeded

# Verify no autologin is configured anywhere
grep -ri "autologin" /etc/lightdm/lightdm.conf /etc/gdm3/custom.conf 2>/dev/null

# CIS Benchmark — GNOME Display Manager: disable automatic mounting of removable media at the login screen
# (a common bypass for physical-access attacks CIS calls out specifically under GDM configuration)
sudo mkdir -p /etc/dconf/db/local.d /etc/dconf/db/local.d/locks
cat << 'EOF' | sudo tee /etc/dconf/db/local.d/00-media-automount
[org/gnome/desktop/media-handling]
automount=false
automount-open=false
EOF
echo "/org/gnome/desktop/media-handling/automount" | sudo tee -a /etc/dconf/db/local.d/locks/media-automount-lock
sudo dconf update

# CIS — ensure XDMCP (remote graphical login) is not enabled — legacy protocol, sends credentials in the clear
grep -i "^Enable=true" /etc/gdm3/custom.conf 2>/dev/null

# List any AppArmor profiles running in complain (non-enforcing) mode
sudo aa-status | grep -A5 "in complain mode"

# SELinux: check recent denials that might indicate something is misconfigured (not necessarily malicious)
sudo ausearch -m avc -ts recent

# CIS Benchmark — Mandatory Access Control: confirm MAC isn't disabled at the bootloader level
# (enforcing mode means nothing if GRUB passes apparmor=0 / selinux=0 at boot)
grep -E "apparmor=0|selinux=0" /etc/default/grub /boot/grub/grub.cfg /boot/grub2/grub.cfg 2>/dev/null

# CIS — SELinux systems: troubleshooting/translation packages should generally be removed on a hardened box
# (they add attack surface and aren't needed once you're done debugging denials)
rpm -q setroubleshoot mcstrans 2>/dev/null
sudo dnf remove -y setroubleshoot mcstrans 2>/dev/null

# Kernel modules worth a manual once-over for anything unfamiliar
lsmod | sort

# Check for LD_PRELOAD set in any global shell/env config, not just /etc/ld.so.preload
grep -r "LD_PRELOAD" /etc/environment /etc/profile* /home/*/.bashrc /root/.bashrc 2>/dev/null

# Verify Apache isn't running as root
ps aux | grep apache2

# Check for directory listing exposure live
curl -s http://localhost/ | grep -i "Index of"

# Verify the config file actually parses/loads cleanly after edits — a syntax error can leave the
# OLD config running (service stays "up" but your fix silently didn't apply) or block a restart entirely
sudo apache2ctl configtest 2>&1 | tail -5
sudo mysqld --validate-config 2>&1 | tail -5   # or: sudo mysqld_safe --help --verbose | grep -A1 "^my.cnf"

# GUI alternative (Mint/Ubuntu): phpMyAdmin or a plain `mysql` client are more reliable than hunting
# for a GUI DB tool during a round — if one's already installed (don't install new software mid-round
# unless needed), it can speed up checking users/hosts visually instead of writing SQL by hand.

# Fallback if Apache isn't the web server in use: nginx keeps the equivalent settings in
# /etc/nginx/nginx.conf and per-site files under /etc/nginx/sites-enabled/ — look for `autoindex on;`
# (nginx's equivalent of Apache's directory listing) and `server_tokens` (version disclosure)
grep -rn "autoindex\|server_tokens" /etc/nginx/ 2>/dev/null

# Edge case: a required service can be configured correctly in its main config file but overridden by
# a per-site/per-vhost config that re-enables what you just turned off — check those too
ls /etc/apache2/sites-enabled/ /etc/apache2/conf-enabled/ 2>/dev/null
grep -rn "Indexes\|ServerSignature" /etc/apache2/sites-enabled/ 2>/dev/null