49.2 Linux Cheat Sheet
Amazon Linux / CentOS-family first – sudo yum + sudo service. Ubuntu: swap install to sudo apt update && sudo apt install … and service names may differ (apache2 vs httpd). Aata pudhe jaauya.
Files and paths
| Command | Meaning | Blue note |
|---|---|---|
pwd | Print working directory | Know where you edit configs before reload |
ls -la | List including hidden + permissions | Spot world-writable secrets (777 on config.php) |
cd /path | Change directory | — |
cp -a src dst | Copy preserving attributes | Backup before risky edit |
mv old new | Move / rename | — |
rm -i file | Remove with prompt | Prefer -i; never blind rm -rf / |
mkdir -p a/b | Create nested dirs | — |
cat / tail -f / less | Read / follow / page a file | tail -f for live log watch in IR |
head -n 20 f | First 20 lines | Quick banner / config peek |
ln -s target link | Symbolic link | Audit unexpected symlinks in web roots |
Permissions, ownership
| Command | Meaning | Blue note |
|---|---|---|
chmod 600 file | Owner read/write only | Private keys / secrets → 600 or tighter |
chmod 644 file | Owner rw; group/other r | Typical public web asset – not secrets |
chmod 755 dir | Dir executable-as-traverse | Avoid 777 on app dirs |
chmod 400 key.pem | Read-only owner (SSH key habit) | Required before ssh -i on many clients |
chown user:group f | Change owner/group | Web files: least-privilege owner, not world |
umask | Default new-file mask | Tighten if lab creates world-readable secrets |
getfacl / setfacl (where available) | ACL view/set | Complex shares – document who has access |
Users, groups, sudo
| Command | Meaning | Blue note |
|---|---|---|
whoami / id | Current user / uid gid groups | Confirm least privilege before admin work |
sudo -l | List allowed sudo | Audit NOPASSWD / broad ALL entries |
useradd -m u / passwd u | Create user / set password | Prefer keys over passwords for SSH |
usermod -aG group u | Add to group | Minimal groups only |
userdel -r u | Delete user + home | Offboarding checklist |
visudo | Edit sudoers safely | Never chmod 777 /etc/sudoers |
last / lastb | Login / failed login history | Brute-force hygiene review |
Processes
| Command | Meaning | Blue note |
|---|---|---|
ps aux / ps -ef | Process list | Spot unexpected listeners / miners in lab IR drills |
top / htop | Live CPU/mem | Sudden CPU spike → investigate |
kill PID / kill -9 PID | Terminate (9 = force) | Prefer graceful stop via sudo service for daemons |
pgrep -a name | Find PIDs by name | — |
nice / renice | Priority | Rare in beginner SOC – know it exists |
Networking
| Command | Meaning | Blue note |
|---|---|---|
ip a / ip r | Addresses / routes | Confirm host-only NIC before scanning |
ss -tulpn | Listening sockets | Close unexpected bind-all services |
ping -c 4 host | Reachability | ICMP may be blocked – not sole health check |
curl -I URL | HTTP headers | Quick TLS / redirect sanity |
dig / nslookup | DNS lookup | Verify expected A/CNAME before go-live |
traceroute host | Path hops | Lab / troubleshooting – not attack |
Packages and services (Amazon Linux focus)
| Command | Meaning | Blue note |
|---|---|---|
sudo yum install -y pkg | Install package | Only needed packages; remove unused later |
sudo yum update -y | Apply updates | Core Blue hygiene – schedule it |
sudo yum check-update | List available updates | Patch planning |
sudo yum remove -y pkg | Remove package | Shrink attack surface |
sudo service name start | Start service | Prefer this over day-to-day systemctl start |
sudo service name stop | Stop service | Disable unused first in hardening |
sudo service name restart | Restart | After config change (test first) |
sudo service name reload | Reload config if supported | Often gentler than full restart |
sudo service name status | Status | Confirm fail2ban / firewalld running |
sudo systemctl enable name | Start on boot | Enable only what must survive reboot |
sudo nginx -t / sudo apachectl configtest | Config syntax test | Always before reload |
Logs, search, archives, disk
| Command | Meaning | Blue note |
|---|---|---|
sudo tail -f /var/log/secure | Auth log follow (RHEL-family) | SSH brute / sudo noise |
sudo journalctl -u name -f | Unit logs (where systemd) | Service crash / fail loops |
grep -Rni pattern dir | Recursive search | Find secrets / TODOs before commit |
find /path -name '*.log' | Find by name | Locate large logs filling disk |
tar -czvf a.tgz dir | Create gzip archive | Lab evidence packs – hash after |
tar -xzvf a.tgz | Extract | Inspect untrusted archives in sandbox |
df -h / du -sh * | Disk free / dir sizes | Full disk = silent outage / log loss |
SSH / SCP and hardening one-liners
| Command / idea | Meaning | Blue note |
|---|---|---|
ssh -i key.pem user@host | SSH with key | Keys-only; chmod 400 the key |
scp -i key.pem f user@host:path | Copy over SSH | Prefer over clear FTP |
sshd: PasswordAuthentication no | Disable password SSH | After key works; second session open |
PermitRootLogin no | No root SSH | Standard harden |
sudo yum install -y fail2ban then sudo service fail2ban start | Ban noisy auth | Tune jails; watch false positives |
sudo yum install -y firewalld + allow only needed ports | Host firewall | Pair with cloud SG least privilege |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Brute SSH password on open port 22 | Keys-only sshd; fail2ban; SG restrict source; lastb review |
| Leaves world-writable web configs | ls -la; chmod 640 secrets; non-root owner |
Skips sudo yum update so old daemons stay open |
Patch cadence; yum check-update; remove unused packages |
Binds MySQL/SSH to 0.0.0.0 “for convenience” |
ss -tulpn; bind localhost where possible; firewalld drop |
Ravindra Bagale's Tip
Day-to-day service control sathi sudo service name start|stop|restart|reload|status vapra. sudo systemctl start avoid kara (boot sathi sudo systemctl enable OK). Package sathi sudo yum – dnf rattu naka unless OS docs force it. Config change → test (nginx -t / apachectl configtest) → mag reload. Samjla ka?
Lab
On YOUR Amazon Linux host-only or Free Tier EC2: (1) ss -tulpn baseline, (2) sudo yum check-update, (3) confirm sudo service sshd status, (4) set a practice user’s key auth in a second session, (5) document three Blue fixes you would apply before any public EIP. No scan outside OWN IPs.