linux Linux Beginner Guide

1. Read the README on the Desktop first. Every CyberPatriot image comes with a scenario document that tells you which users, groups, and services are supposed to exist. It overrides everything in this guide — if the README says "Dave needs an account," do not delete Dave.
2. Don't delete things you're not sure about. Locking or disabling something is reversible. Deleting it might not be. When in doubt, disable/lock instead of delete.
3. Be careful with SSH. It's very easy to accidentally lock yourself out of the machine while editing SSH settings. Read the SSH section below carefully before touching anything.
4. Take a snapshot before you start. See the very next section — do this before you make a single change.
5. Work top to bottom, and don't panic. You don't need to finish everything. Partial progress on many sections beats perfect progress on one.

Before you change any setting, take a snapshot (sometimes called a "checkpoint") of the virtual machine in whatever program is running it:

• VirtualBox: Machine menu → Take Snapshot
• VMware: VM menu → Snapshot → Take Snapshot
• Hyper-V: Right-click the VM → Checkpoint

A snapshot is a save point for the entire virtual machine, not something inside the operating system itself. If you make a mistake later — for example, you accidentally lock yourself out over SSH, or a firewall change cuts off your own access — you can revert to this snapshot and try again instead of losing the whole round. Name it something you'll recognize, like start.

Take another snapshot any time you're about to do something risky (restarting SSH, turning on the firewall, editing system files you don't fully understand yet) and once more near the end before you're done, in case something breaks in the last few minutes.

If you've never used a terminal, read this once — everything below will make more sense.

• The terminal is a text-based window where you type commands instead of clicking icons. On Mint/Ubuntu, look for "Terminal" in the applications menu, or press Ctrl+Alt+T.
• A file path is just an address for a file or folder, written with forward slashes. /etc/passwd means: starting from the very top of the filesystem (/), go into the etc folder, and there's a file called passwd. /home/alice means the folder home, then inside it a folder called alice.
• sudo stands for "superuser do." Normal users can't change system settings or read certain protected files — sudo temporarily gives you administrator (root) power for one command. You'll type your own password (not the root password) when prompted. Almost every command in this guide starts with sudo because you're editing security settings.
• /etc/passwd is the file that lists every user account on the system (their username, an ID number, and other info — but not their actual password; that's in a separate, more protected file called /etc/shadow).
• Piping (|) takes the output of one command and feeds it into another command, so you can chain simple tools together. For example, cat /etc/passwd | grep root shows the contents of /etc/passwd (via cat) and then filters (grep) that output down to only lines containing "root."
• Comments: anything after a # in a command is just an explanation for humans — you don't need to type it (though it's harmless if you do, on its own line).
• Commands in this guide are in gray boxes. Type (or copy) them exactly, including the sudo at the front, and press Enter.

• Open the README on the Desktop and read it fully. Write down: which users should exist, which services need to keep running, and anything explicitly allowed.
• Get your bearings on what OS you're working with:

cat /etc/os-release

This prints out basic info about the operating system so you know whether you're on Ubuntu, Mint, Debian, Fedora, or CentOS. That matters because the command to install software is different depending on the family:

This guide shows the Ubuntu/Mint/Debian command first, with the Fedora/CentOS/RHEL equivalent noted alongside it.

Why this matters: Competition images are often seeded with an extra account that shouldn't be there, or an account with admin rights it shouldn't have. This is usually one of the highest-value, lowest-effort things you can fix.

• List every user account, their ID number, and their shell:

cat /etc/passwd | awk -F: '{print $1, $3, $7}'

awk here is just splitting each line by the : character (that's what -F: means) and printing the 1st, 3rd, and 7th piece — which are the username, the ID number, and the shell that account gets when it logs in. Compare the list of usernames against the README's list of who should exist.

• The single most important check: find any account other than root that has ID number 0. ID 0 means "full administrator," and only the built-in root account should ever have it:

awk -F: '($3 == 0) {print}' /etc/passwd

If this prints anything besides a line starting with root, that's a planted attacker account with full system control. That's a serious problem — flag it immediately.

• Check who's allowed to use sudo (become an administrator). Compare this list against your README:

getent group sudo

On Fedora/CentOS/RHEL, the equivalent admin group is called wheel:

getent group wheel

• If someone is in the sudo/wheel group who shouldn't be, remove them from that group (this does not delete their account, just removes their admin rights):

sudo deluser <username> sudo

On Fedora/CentOS/RHEL:

sudo gpasswd -d <username> wheel

• Check for accounts with no password set at all — this is a serious vulnerability, since anyone can log in with just the username:

sudo awk -F: '($2 == "") {print $1}' /etc/shadow

/etc/shadow is the protected file that actually stores password information (that's why this command needs sudo). An empty second field means no password is required to log in as that user.

• For any account that's clearly unauthorized, lock it rather than deleting it — locking is safer because it's reversible, and deleting an account you were wrong about can cost you more than leaving it locked:

sudo passwd -l <username>

• Set a real password for every account that should exist and doesn't have a strong one:

sudo passwd <username>

You'll be prompted to type a new password twice.

GUI alternative (Mint/Ubuntu): open Users and Groups from the applications menu to add/remove users and change passwords with clicks instead of commands, if you'd rather do this visually.

Why this matters: Even correct passwords are weak if the system allows them to never expire or be extremely short. A quick policy fix is a fast way to close that gap.

• Open /etc/login.defs in a text editor to see current password aging rules:

sudo nano /etc/login.defs

(nano is a simple, beginner-friendly text editor that runs inside the terminal. Use the arrow keys to move around, and Ctrl+O then Enter to save, Ctrl+X to exit.)

• Find and change these three lines (or add them if they're missing):

PASS_MAX_DAYS   90
PASS_MIN_DAYS   10
PASS_MIN_LEN    8

This means passwords must be changed at least every 90 days, can't be changed more than once every 10 days (to stop someone from cycling back to an old password immediately), and must be at least 8 characters.

• Install a tool that enforces password complexity (requiring a mix of upper/lowercase, numbers, etc.) when a user sets a new password:

sudo apt install libpam-pwquality -y

On Fedora/CentOS/RHEL, pam_pwquality is usually already installed; if not:

sudo dnf install pam_pwquality -y

Don't worry about deeply configuring this tool as a beginner — just having it installed and enabled covers the basics. The Master Checklist has more advanced configuration if you want to go further later.

Why this matters: SSH lets someone log into this machine remotely. If it's misconfigured (for example, allowing the root user to log in directly, or allowing blank passwords), it's one of the easiest ways for an attacker to get in.

Be careful here. If you're connected to this machine through SSH right now, a mistake in this section could disconnect you. If you're working directly on the machine (not remotely), you're safe from that specific risk, but a syntax mistake could still stop SSH from starting at all. Take a snapshot before continuing if you haven't already.

• Open the SSH configuration file:

sudo nano /etc/ssh/sshd_config

• Find the line with PermitRootLogin and set it to no. This stops anyone from logging in remotely as the root/admin user directly — a huge and common vulnerability:

PermitRootLogin no

• Find PermitEmptyPasswords and make sure it's set to no:

PermitEmptyPasswords no

• Save the file (Ctrl+O, Enter, then Ctrl+X in nano).
• Before restarting SSH, check the file for typos — this step can save you from locking yourself out:

sudo sshd -t

If this command prints nothing, your file is fine. If it prints an error, go back and fix the line it mentions before continuing.

• Now restart the SSH service so your changes take effect:

sudo systemctl restart sshd

(On some Debian/Ubuntu systems the service is named ssh instead of sshd — if the above gives an error, try sudo systemctl restart ssh.)

If the README doesn't mention SSH being required at all, it may be safer and simpler to just turn it off entirely: sudo systemctl disable --now sshd. Only do this if you're sure remote access isn't part of the scenario.

Why this matters: A firewall controls what network connections are allowed in and out of the machine. Competition images are frequently graded on whether a firewall is active and configured to block unnecessary traffic.

• On Ubuntu/Mint/Debian, the firewall tool is called ufw ("Uncomplicated Firewall"). Install it if it's missing:

sudo apt install ufw -y

• Set the default rule to block all incoming connections, and allow all outgoing ones:

sudo ufw default deny incoming
sudo ufw default allow outgoing

• If SSH is required by your README, explicitly allow it before you turn the firewall on, so you don't lock yourself out:

sudo ufw allow 22/tcp

• Turn the firewall on:

sudo ufw enable

• Check that it's actually running and see your rules:

sudo ufw status verbose

GUI alternative (Mint/Ubuntu): install and open gufw ("Firewall Configuration") for a point-and-click version of the same tool: sudo apt install gufw -y

On Fedora/CentOS/RHEL, the default firewall tool is firewalld instead:

sudo systemctl enable --now firewalld
sudo firewall-cmd --set-default-zone=drop
sudo firewall-cmd --permanent --add-service=ssh   # only if SSH is required
sudo firewall-cmd --reload

Why this matters: Unnecessary services (things like file-sharing, old chat servers, or remote-desktop tools) are extra doors into the system. If your README doesn't mention needing them, they should usually be turned off.

• List all services currently enabled to start automatically:

systemctl list-unit-files --type=service --state=enabled

• Compare this list against your README. Anything not required and not part of the base operating system is worth investigating.
• To turn off a service you've identified as unnecessary:

sudo systemctl disable --now <service-name>

disable stops it from starting automatically in the future, and --now also stops it immediately.

Don't disable something you don't recognize without checking the README first — some services have unfamiliar names but are required (for example, a web server package if the scenario needs one). When unsure, look it up before turning it off.

Why this matters: Outdated software often has known, published security holes. Updating is one of the simplest and most reliable ways to close them.

• Check that you have internet access first — some competition images are offline, and update commands will just hang if so:

ping -c 2 8.8.8.8

Press Ctrl+C to stop it if it's not getting a response after a few seconds.

• On Ubuntu/Mint/Debian:

sudo apt update && sudo apt upgrade -y

apt update refreshes the list of what software versions are available; apt upgrade -y actually installs the newer versions (the -y automatically answers "yes" to the confirmation prompt).

• On Fedora/CentOS/RHEL:

sudo dnf update -y

GUI alternative (Mint/Ubuntu): open Software Updater (sometimes called Update Manager) from the applications menu — it does the same thing with a progress bar.

Why this matters: Competition images sometimes have a rootkit or malware sample deliberately planted to test whether you'll find it.

• Install a rootkit scanner:

sudo apt install rkhunter -y

On Fedora/CentOS/RHEL:

sudo dnf install rkhunter -y

• Run it:

sudo rkhunter --check

This will scan the system and print a long report, pausing for you to press Enter between sections. Most of what it flags on a stock system is a false positive (a normal file that just looks slightly unusual) — don't panic and start deleting things. If you see a clear warning about something suspicious, note it down and investigate further, or ask a teammate/mentor before acting on it.

Why this matters: CyberPatriot scenarios often plant media files (music, movies) or hacking tools in a user's home folder as a scored item — these are supposed to be found and removed.

• Search everyone's home folder for common media file types:

sudo find /home -iname "*.mp3" -o -iname "*.mp4" -o -iname "*.avi"

This command means: starting at /home, find any file whose name ends in .mp3, .mp4, or .avi (case-insensitive, thanks to -iname). If it finds any, review them — if they're clearly unauthorized media, delete them.

• Check whether any well-known hacking/pentesting tools are installed (things like network scanners or password crackers have no business being on this machine unless the README says otherwise):

which nmap wireshark netcat john hydra

which tells you the location of a program if it's installed, or prints nothing if it isn't. If any of these come back with a path, and your README doesn't call for them, remove the package:

sudo apt purge -y <package-name>

Why this matters: A few core system files should only be editable by the administrator (root). If their permissions have been loosened, that's an easy way for a regular user to tamper with accounts or passwords.

• Check the permissions on two of the most important files:

ls -l /etc/passwd /etc/shadow

You should see something close to -rw-r--r-- for /etc/passwd and -rw-r----- (or more restrictive) for /etc/shadow, both owned by root. If either file shows w (write) permission for "everyone" (the last set of three letters), that's a problem — any user could edit account data.

• Fix it if needed:

sudo chmod 644 /etc/passwd
sudo chmod 640 /etc/shadow

Why this matters: cron is Linux's built-in scheduler for running commands automatically at set times. Attackers sometimes use it to run a hidden script every few minutes to reopen a backdoor.

• Check root's scheduled tasks and your own:

sudo crontab -l
crontab -l

(It's normal for this to say "no crontab for <user>" — that just means nothing is scheduled.)

• Check the system-wide schedule file and folders:

cat /etc/crontab
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/

• If you see an entry you don't recognize — especially anything that downloads a file, opens a network connection, or runs from an odd location like /tmp — flag it and remove or comment it out (put a # at the start of that line to disable it without deleting it).

At this point you've covered the fundamentals: verified users and passwords, hardened SSH, turned on the firewall, updated the system, scanned for malware, removed prohibited files, and sanity-checked permissions and cron.

• Take another snapshot now that things are stable, in case something breaks later and you need to come back to this point.
• Re-read the README one more time and confirm nothing you changed broke a required user, service, or piece of functionality.

When you're ready to go deeper — SSH hardening details, kernel/sysctl settings, AppArmor/SELinux, rootkit persistence hunting, and more — move on to the full Linux Master Checklist.