Labs · Cyber Security

Lab: Make Your Own One-Page Defensive Command Cheat Sheet and Test Every Command in Your Lab

By Ravindra Bagale · Last updated: 8 October 2026

Suppose we are…

Suppose we are on the night shift in the SOC at Wipro. When an alert fires at 3 a.m., nobody wants to search Google for the right grep or ss command. Experienced analysts keep a tested one-page cheat sheet on their desk. We build ours from the commands we used in this course, and we test each one so we know it works on our systems.

Goal of this lab

By the end you will have:

• 20 commands in four groups: Check, Harden, Detect, Recover.
• Each command tested on your own VM, with a short "expected output" note and the lab it came from.
• A one-page PDF or printout.

What you need (all free)

• Your own Ubuntu Server VM with the tools from earlier labs (ufw, fail2ban, auditd). A text editor or Google Docs. About 45 minutes.

Steps

1. Create a document with a table: Group, Task, Command, Expected output (short), Lab, Tested ✓.

2. Add these 20 starter commands (change or replace any to match your work). The comment after # gives the task and the lab it came from:

   # CHECK
   sudo ss -tulpn                                        # listening ports (Lab 2)
   getent group sudo                                     # who is admin (Lab 26)
   apt list --upgradable                                 # pending updates (Lab 23)
   df -h                                                 # disk usage (Lab 5)
   sudo find / -xdev -perm -4000 -type f 2>/dev/null     # SUID files (Lab 26)
   # HARDEN
   sudo sshd -t                                          # test SSH config (Lab 32)
   sudo sshd -T | grep -E "passwordauth|permitroot"      # effective SSH settings (Lab 32)
   sudo ufw status verbose                               # firewall status (Lab 32)
   sudo nginx -t                                         # test Nginx config (Lab 7)
   curl -I https://yourdomain                            # check security headers (Lab 8)
   # DETECT
   grep "Failed password" /var/log/auth.log | grep -oE "from [0-9.]+" | sort | uniq -c | sort -rn   # failed SSH per IP (Lab 31)
   grep "Accepted" /var/log/auth.log                     # successful logins (Lab 31)
   last -n 10                                            # recent logins (Lab 6)
   sudo fail2ban-client status sshd                      # current bans (Lab 32)
   sudo ausearch -k identity -i | tail                   # audit events by key (Lab 36)
   # RECOVER
   sha256sum file                                        # hash a file (Lab 28)
   sha256sum -c hashes.txt                               # verify hashes (Lab 28)
   sudo tar -czf /root/backups/etc-$(date +%F).tgz /etc  # back up config (Lab 45)
   sudo tar -tzf /root/backups/etc-<date>.tgz | head     # list backup contents (Lab 45)
   sudo systemctl restart ssh && systemctl status ssh --no-pager   # restart and check (Lab 23)
   

3. Start your VM and run each command. Fill Expected output in under 8 words, for example ufw status → "Status: active, 22/tcp ALLOW".

   👁 What you should see: every command runs without "command not found". If one fails, install the tool or fix the command, then retest.

4. Tick Tested ✓ only after it worked on your VM. Remove commands you cannot make work, or note the fix.

5. Add one "danger" line at the bottom of the Harden group: "Before restarting SSH or enabling a firewall, keep a second session open."

6. Make it fit one page: font 9–10 pt, landscape, narrow margins, short task names. Export to PDF (File → Download → PDF in Google Docs, or File → Save as → PDF in Word).

   👁 What you should see: all 20 commands readable on one A4 page.

7. Print it or keep the PDF on your phone. Next time you use a new command in a lab, test it and add it, replacing one you no longer need.

Common mistakes

Self-check checklist

Try-at-home challenge

Your sheet has grep "Failed password" /var/log/auth.log. Write the equivalent command for Amazon Linux 2023, which has no auth.log, and test it on your EC2 server.

Samjla ka? Pick, test, note the expected output, fit it on one page. Aata pudhe jaauya: Chapter 50 builds your bilingual glossary.