CyberPatriot Field Guide
Speed Reference

linux Linux Speed Reference

Condensed, no-explanation command sheet for when the clock is running.

0 / 0 checked

Recall/scan sheet only — read the Master Checklist or Beginner Guide first. Covers apt/dpkg (Debian/Ubuntu/Mint) with yum/dnf noted where it differs.

0. Before Anything#

  • Snapshot. Read README. cat /etc/os-release. Answer forensics questions before changing anything.

1. Users / Groups#

bash
awk -F: '($3 == 0) {print}' /etc/passwd                 # non-root UID 0 = red flag
awk -F: '($2 == "" || $2 == "!") {print $1}' /etc/shadow  < /etc/shadow   # empty/locked passwords
getent group sudo   # or: getent group wheel
sudo passwd -l <user>      # lock instead of userdel — safer, don't lose points breaking required accounts

2. Password Policy#

File Setting Value
/etc/login.defs PASS_MAX_DAYS 90
/etc/login.defs PASS_MIN_DAYS 7–10
/etc/login.defs PASS_WARN_AGE 7–14
/etc/pam.d/common-password pam_pwquality.so retry=3 minlen=14 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
/etc/pam.d/common-auth pam_tally2/pam_faillock deny=5 unlock_time=1800
bash
sudo chage -M 90 -m 7 -W 14 <user>    # apply login.defs values to EXISTING users too — login.defs only affects new accounts

3. SSH (/etc/ssh/sshd_config)#

Setting Value
PermitRootLogin no
PasswordAuthentication no (only if key-based confirmed working — don't lock yourself out)
PermitEmptyPasswords no
X11Forwarding no
MaxAuthTries 3-4
bash
sudo sshd -t                    # ALWAYS test syntax before restart
sudo systemctl restart sshd

4. Firewall#

bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow <required-port>/tcp
sudo ufw enable
sudo ufw status verbose

5. Services / Ports#

bash
sudo ss -tulnp
systemctl list-unit-files --type=service --state=enabled
sudo systemctl disable --now <service>

6. Malware / Prohibited Files#

bash
sudo find / -iname "*.mp3" -o -iname "*.mp4" 2>/dev/null
which nmap nc netcat john hydra aircrack-ng wireshark 2>/dev/null   # netcat-openbsd default = usually NOT points; extra netcat variants/random locations ARE
sudo rkhunter --check
sudo chkrootkit

7. Permissions#

bash
sudo find / -xdev -type f -perm -0002 -ls 2>/dev/null       # world-writable
sudo find / -perm -4000 -o -perm -2000 2>/dev/null            # SUID/SGID

8. Cron / Persistence#

bash
crontab -l; sudo crontab -l
ls -la /etc/cron.* /etc/rc.local
systemctl list-timers --all

9. Bash / Kernel Checks#

bash
bash --version
env x='() { :;}; echo vulnerable' bash -c "echo test"      # Shellshock check — legacy images mostly
sudo apt update && sudo apt install --only-upgrade bash

10. Config-File Content (not just enable/disable, if required by README)#

  • Apache: ServerTokens Prod, ServerSignature Off, Options -Indexes.
  • MySQL/MariaDB: no anonymous users, no remote root, bind-address restricted if not needed remotely.

11. Updates#

bash
sudo apt update && sudo apt upgrade -y      # apt family
sudo dnf update -y                          # dnf family

12. Final Pass#

  • Snapshot again. Confirm required services/users still work. Re-answer forensics questions.