Command Center · Reference 03
Linux Quick Reference
Fast Ubuntu and Mint lookup for accounts, sudo, permissions, packages, services, processes, networking, firewall, logs, cron, systemd timers, SSH, file metadata, and common paths.
Use inspection commands first. Preserve evidence and understand dependencies before removing packages, disabling services, or changing permissions.
Linux Rule
Before changing Linux
Small commands can have large system-wide effects
Package removal, permission changes, service changes, firewall edits, and sudo policy changes can quickly break required functionality. Inspect first and make the narrowest justified change.
Ubuntu / Mint
Users & Groups
getent passwd
Lists local and directory-backed user accounts visible to the system.
Caution
Account presence does not prove recent or legitimate use.
getent group
Lists groups and visible membership data.
Caution
Group membership can grant privilege; verify whether it is expected before changing it.
id <username>
Shows UID, primary group, and supplementary groups for one account.
Caution
Use the actual account name from the system or scenario.
who
Shows currently logged-in users and terminals.
Caution
This is current-session evidence only.
last
Shows recent login history from wtmp where available.
Caution
Historical records can be incomplete or rotated.
Ubuntu / Mint
Sudo & Privilege
getent group sudo
Shows members of the sudo group on Ubuntu/Mint systems.
Caution
Membership provides privilege capability but does not prove use.
sudo -l -U <username>
Shows sudo permissions for a selected user.
Caution
Run only when appropriate and authorized; output depends on sudoers configuration.
sudo visudo -c
Checks sudoers syntax without intentionally editing policy.
Caution
Use visudo for actual edits to avoid syntax errors.
grep -R "^[^#].*ALL" /etc/sudoers /etc/sudoers.d 2>/dev/null
Searches active-looking sudoers rules for review.
Caution
Interpret aliases and included files carefully; a simple grep is not a full policy parser.
Ubuntu / Mint
File Permissions & Ownership
ls -l <path>
Shows mode bits, owner, group, size, and timestamp.
Caution
Standard ls output does not show every ACL entry.
stat <path>
Shows detailed metadata including mode, owner, timestamps, and inode.
Caution
Linux ctime is metadata-change time, not file creation time.
getfacl <path>
Shows POSIX ACL entries where supported.
Caution
Extended ACLs can affect access even when basic mode bits look restrictive.
find /path -xdev -type f -perm -0002 2>/dev/null
Finds world-writable files within a selected filesystem tree.
Caution
Scope the path deliberately instead of scanning the whole system blindly.
Ubuntu / Mint
Packages
dpkg -l
Lists installed Debian packages and package state.
Caution
Installed does not automatically mean unnecessary or unsafe.
apt list --installed 2>/dev/null
Lists packages recognized as installed by APT.
Caution
Do not remove software before checking required functionality.
apt-cache policy <package>
Shows installed and candidate package versions.
Caution
Repository state may differ if package lists are stale.
grep -h " install " /var/log/dpkg.log* 2>/dev/null | tail -n 50
Shows recent package-install records from dpkg logs.
Caution
Rotated or compressed logs may require additional review.
Ubuntu / Mint
Services & systemd
systemctl --type=service --state=running
Lists currently running systemd services.
Caution
A running service is not automatically required, and a stopped service is not automatically safe.
systemctl status <service>
Shows current state, recent logs, unit path, and process information.
Caution
Review dependencies and scenario requirements before stopping or disabling a service.
systemctl is-enabled <service>
Shows whether the service is enabled to start automatically.
Caution
Enabled state and running state are separate concepts.
systemctl cat <service>
Displays the effective unit file and drop-in overrides.
Caution
Drop-ins can change behavior from the vendor default.
Ubuntu / Mint
Processes
ps aux
Shows a broad snapshot of running processes.
Caution
Process name alone does not establish legitimacy.
ps -eo pid,ppid,user,lstart,cmd --sort=pid
Shows PID, parent PID, user, start time, and command line.
Caution
Command lines can be incomplete for protected or exited processes.
pstree -ap
Shows process parent-child relationships with PIDs and arguments.
Caution
Parent relationships help with context but do not prove maliciousness.
readlink -f /proc/<pid>/exe
Resolves the executable backing a running process when accessible.
Caution
Processes can exit between inspection steps; preserve volatile evidence quickly.
Ubuntu / Mint
Networking
ip addr
Shows network interfaces and configured IP addresses.
Caution
Virtual, loopback, and inactive interfaces may also appear.
ip route
Shows the routing table.
Caution
Unexpected routes should be investigated before deletion.
ss -tulpn
Shows listening TCP/UDP sockets with process information when permissions allow.
Caution
A listening port does not automatically mean it is remotely reachable or unsafe.
ss -tpn
Shows active TCP connections and associated processes.
Caution
Connection presence is an observation, not proof of malicious activity.
resolvectl status
Shows DNS configuration on systems using systemd-resolved.
Caution
Some Ubuntu/Mint installations may use different DNS management.
Ubuntu / Mint
Firewall
sudo ufw status verbose
Shows UFW state, defaults, and configured rules.
Caution
Do not enable, disable, or delete rules until required services are known.
sudo ufw status numbered
Shows numbered UFW rules for easier review.
Caution
Rule order and defaults influence actual behavior.
sudo nft list ruleset
Shows the nftables ruleset where nftables is in use.
Caution
Avoid editing low-level firewall rules unless the environment and requirements are clear.
sudo iptables -S
Shows iptables rules in rule syntax where legacy iptables is in use.
Caution
Ubuntu systems may use nftables underneath compatibility commands.
Ubuntu / Mint
Logs & journalctl
journalctl -p warning..alert -b
Shows warning-and-higher journal events from the current boot.
Caution
Severity filtering can hide important informational events.
journalctl -u <service> --since "2 hours ago"
Shows recent journal entries for one service.
Caution
Use a time window relevant to the investigation.
sudo tail -n 100 /var/log/auth.log
Shows recent authentication-related events on many Ubuntu/Mint systems.
Caution
Some systems use journald-only logging or different file locations.
sudo tail -n 100 /var/log/syslog
Shows recent general system log entries where syslog exists.
Caution
Not every distribution or configuration uses this file.
lastlog
Shows last-login information per account.
Caution
Never treat one login database as the only source of truth.
Ubuntu / Mint
Cron & systemd Timers
crontab -l
Shows the current user's crontab.
Caution
Other users and system-wide cron locations must be checked separately.
sudo crontab -l
Shows root's crontab.
Caution
Root cron jobs may be legitimate administrative tasks.
ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly
Shows common system-wide cron directories.
Caution
Presence does not prove execution; inspect timestamps and content.
systemctl list-timers --all
Lists systemd timers, last run, and next run information.
Caution
Inspect the associated service unit before making changes.
Ubuntu / Mint
SSH & Remote Access
systemctl status ssh
Shows OpenSSH server state when installed as ssh.service.
Caution
Remote access may be required; check scenario instructions before disabling it.
ss -ltnp | grep ':22 '
Checks whether something is listening on TCP 22.
Caution
Map the listener to its process and verify whether SSH is required.
sudo sshd -T
Shows effective OpenSSH server configuration when sshd is installed.
Caution
Review output carefully; configuration may include included files.
grep -R "^[[:space:]]*[^#]" /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/null
Shows active-looking SSH configuration lines and included snippets.
Caution
The effective configuration is better confirmed with sshd -T when available.
Ubuntu / Mint
Files, Hashes & Metadata
sha256sum <file>
Calculates a SHA-256 hash of a file.
Caution
A hash identifies file content; it does not tell you whether the file is safe.
file <file>
Identifies file type from content rather than filename extension.
Caution
File-type identification is useful but not a malware verdict.
stat <file>
Shows timestamps, owner, mode, size, and inode information.
Caution
Interpret mtime, atime, and ctime correctly.
readlink -f <path>
Resolves symbolic links to their final target path.
Caution
The target may change later; record the result if it matters.
Account files
Files worth recognizing
/etc/passwdAccount name, UID, GID, home directory, shell.
/etc/shadowPassword hashes and aging data; root-readable.
/etc/groupGroup definitions and supplementary membership.
/etc/gshadowProtected group security information.
Permission math
Numeric mode reminder
Example: chmod 640 file means owner read/write, group read, others no permissions. Avoid broad permissions such as 777 unless there is a clearly justified requirement.
Important paths
Common Linux locations worth recognizing
/etc/passwdLocal account definitions and UID information.
/etc/groupLocal group definitions and membership.
/etc/sudoersPrimary sudo policy file.
/etc/sudoers.d/Additional sudo policy snippets.
/etc/ssh/sshd_configPrimary OpenSSH server configuration.
/var/log/auth.logAuthentication events on many Ubuntu/Mint systems.
/var/log/syslogGeneral system logging on many Ubuntu/Mint systems.
/var/log/apt/APT package-management history.
/var/log/dpkg.logPackage install/remove history from dpkg.
/etc/cron.d/System-wide cron definitions.
/etc/systemd/system/Administrator-created or overridden systemd units.
/home/<user>/.config/autostart/Per-user desktop autostart entries where used.
/tmpTemporary storage; useful but noisy.
/var/tmpLonger-lived temporary storage.
Decision check
Ask these before changing Linux configuration
Is the account, service, package, or port required by the scenario?
Who owns the process or file?
What is the full executable or file path?
Is the service enabled, running, both, or neither?
Do logs show when the activity occurred?
Is there a cron job, systemd timer, autostart item, or service that explains the activity?
Do I need to preserve a hash, PID, command line, log entry, or timestamp first?
What is the smallest justified change?
How will I verify required functionality afterward?
Common mistakes
Linux mistakes that cause avoidable damage
Removing a package simply because you do not recognize its name.
Disabling SSH without checking whether remote administration is required.
Confusing service enabled state with current running state.
Treating ctime as file creation time.
Changing permissions broadly with chmod 777 instead of fixing the specific access problem.
Deleting a cron job or timer before recording its command, account, and timing.
Killing a process before recording executable path, command line, parent PID, and network state.
Assuming an open port is automatically a vulnerability.