Competition Checklist · 04 · Linux
Linux Ubuntu & Mint Checklist
Review users, sudo, permissions, packages, services, SSH, cron, systemd timers, processes, listeners, firewall state, and logs without breaking required Linux functionality.
The same defensive reasoning applies to both Ubuntu and Mint: inspect first, preserve useful evidence, make narrow changes, and verify required services after remediation.
Quick Use
Linux rule
Do not confuse unfamiliar with malicious
Linux systems contain many legitimate services, packages, scheduled jobs, service users, and privileged binaries. Confirm purpose, ownership, path, dependencies, and mission requirements before changing them.
Opening pass
Understand the Linux image before hardening it
Read the Linux image requirements before changing users, sudo, SSH, services, packages, or scheduled activity.
Ubuntu and Mint competition images may require specific accounts, services, software, and remote-access behavior.
Record approved users and approved sudo-capable users.
This gives you a trusted reference before disabling accounts or changing privileged group membership.
Confirm required services and applications.
Do not stop SSH, web services, database services, backup jobs, or other daemons until the mission confirms they are unnecessary.
Capture the current user, group, sudo, service, process, listener, cron, and timer state.
A baseline helps you identify pre-existing conditions and verify the effect of later changes.
Check authentication and system logs early.
Logs can reveal suspicious logins, sudo activity, failed authentication, service restarts, and scheduled behavior before remediation changes the evidence.
Separate active risk from ordinary hardening.
Unknown privileged users, suspicious persistence, disabled security controls, and unexpected listeners deserve attention before cosmetic cleanup.
Identity
Confirm users before changing account state
Local users
cut -d: -f1,3,4,7 /etc/passwd
getent passwd
Every interactive user is approved, expected, or documented before account changes.
Privileged groups
getent group sudo
getent group adm
Only approved users retain membership in privilege-sensitive groups.
Effective sudo rights
sudo -l -U <username>
Review what the user can actually run instead of assuming group membership tells the full story.
Locked or disabled accounts
sudo passwd -S <username>
sudo awk -F: '($2=="!" || $2=="*"){print $1}' /etc/shadowDisabled accounts are compared with the mission before re-enabling or deleting them.
Sudo & privilege
Review effective administrative access
Main sudoers file
sudo visudo -c
sudo cat /etc/sudoers
Syntax is valid and rules grant only required privilege.
sudoers.d entries
sudo ls -la /etc/sudoers.d
sudo grep -RInE 'NOPASSWD|ALL=\(ALL' /etc/sudoers /etc/sudoers.d 2>/dev/null
Unexpected NOPASSWD or broad ALL rules are investigated before removal.
Group-based privilege
getent group sudo
id <username>
Privilege through group membership matches the approved roster.
Sudo activity
sudo grep -i sudo /var/log/auth.log | tail -n 100
sudo journalctl _COMM=sudo --no-pager -n 100
Suspicious administrative activity is correlated with users and timestamps.
Permissions
Check ownership, modes, privileged files, and ACLs
Sensitive file permissions
ls -l /etc/passwd /etc/shadow /etc/group /etc/gshadow
Sensitive credential and identity files are not broadly writable or readable beyond expected defaults.
World-writable files
sudo find /etc /usr/local /opt -xdev -type f -perm -0002 -ls 2>/dev/null
World-writable configuration or executable files are investigated because they can enable tampering.
SUID / SGID files
sudo find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null
Unexpected privileged executables are compared with known system packages and mission requirements.
ACLs
getfacl <path>
File ACLs are checked when ordinary mode bits do not explain effective access.
Services
Protect required daemons while investigating exposure
Running services
systemctl --type=service --state=running
Every unusual daemon is investigated before it is stopped or disabled.
Enabled services
systemctl list-unit-files --type=service --state=enabled
Automatic startup matches mission requirements.
Service details
systemctl status <service>
systemctl cat <service>
Review executable paths, environment, dependencies, and unit configuration before remediation.
Recent service activity
journalctl -u <service> --no-pager -n 100
Restarts, crashes, or unusual activity are preserved as evidence before changes.
SSH
Review remote access without locking out approved administration
SSH service
systemctl status ssh
systemctl status sshd
SSH is running only if required by the mission.
SSH configuration
sudo sshd -T 2>/dev/null
sudo grep -RInE 'PermitRootLogin|PasswordAuthentication|AllowUsers|AllowGroups' /etc/ssh 2>/dev/null
Remote access settings restrict exposure without blocking approved administration.
SSH listeners
sudo ss -lntp | grep ':22'
The listener is expected, required, and bound appropriately.
SSH authentication evidence
sudo grep -Ei 'sshd.*(Accepted|Failed)' /var/log/auth.log | tail -n 100
sudo journalctl -u ssh --no-pager -n 100
Successful and failed remote logins are correlated with approved users and source systems.
Persistence
Review cron, timers, and startup behavior
User cron
crontab -l
sudo crontab -l
Scheduled commands are expected and required before removal.
System cron
sudo ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /etc/cron.monthly
sudo cat /etc/crontab
Unexpected scripts or jobs are reviewed by owner, command, path, and schedule.
Systemd timers
systemctl list-timers --all
Unexpected timers are correlated with their associated service units.
Shell startup files
grep -RInE 'curl|wget|nc|bash -c|python|perl' ~/.bashrc ~/.profile /etc/profile /etc/profile.d 2>/dev/null
Unusual startup commands are investigated before deletion.
Processes
Preserve process context before containment
Process inventory
ps auxf
Unknown processes are reviewed by user, parent, command line, executable path, and network activity.
Process tree
pstree -ap
Parent-child relationships are used to understand how suspicious processes started.
Open files
sudo lsof -p <PID>
Files, sockets, and working directories help explain process behavior.
Executable path
readlink -f /proc/<PID>/exe
tr '\0' ' ' < /proc/<PID>/cmdline
The real executable and command line are captured before containment.
Network
Map interfaces, listeners, connections, and firewall state
IP configuration
ip addr
ip route
Addresses, interfaces, gateways, and routes match the intended environment.
Listening sockets
sudo ss -lntup
Every important listener is tied to a process and service purpose.
Active connections
sudo ss -ntup
Unexpected remote connections are correlated with owning processes.
Firewall state
sudo ufw status verbose
sudo nft list ruleset 2>/dev/null
Firewall policy preserves required services while reducing unnecessary exposure.
Log quick reference
Linux evidence sources worth checking
auth.log
Authentication, SSH, sudo
sudo tail -n 100 /var/log/auth.log
journal
Services and system activity
sudo journalctl --since '2 hours ago' --no-pager
syslog
General system events
sudo tail -n 100 /var/log/syslog
last
Recent user sessions
last -a | head -n 50
lastb -a | head -n 50
High-priority findings
Preserve the evidence, then make the narrowest justified change
Unapproved user with sudo
Preserve identity, group, sudoers, and authentication evidence, confirm the roster, then remove excess privilege if unauthorized.
Unexpected SSH exposure
Confirm whether SSH is required, preserve login evidence, review configuration and listeners, then restrict or disable only if justified.
Suspicious process with active network connection
Record PID, executable path, command line, parent, open files, and network details before containment.
Unknown cron job or systemd timer
Record the schedule, command, owner, path, associated unit, and timestamps before disabling it.
World-writable sensitive configuration
Record current mode, ownership, ACLs, and expected package defaults before correcting permissions.
Required service stopped or broken
Restore mission-critical functionality first, then investigate why the service state changed.
Do not blindly change
Common Linux competition overreactions
Do not delete every unfamiliar user before checking the approved roster.
Do not remove sudo from a user until you verify whether the mission requires it.
Do not disable SSH simply because port 22 is listening.
Do not stop all unfamiliar services.
Do not delete cron jobs or timers before recording what they run.
Do not change ownership or permissions broadly with recursive commands unless the scope is fully understood.
Do not remove packages merely because you do not recognize them.
Do not kill a suspicious process before preserving path, command line, parent, and network evidence.
Verification sweep
Prove the Linux image still satisfies the mission
Users
Approved users remain and unapproved identities are handled appropriately.
Privilege
sudo and sensitive group membership match the mission.
Permissions
Sensitive files have appropriate ownership, modes, and ACLs.
Services
Required services are active and unnecessary services were changed only with evidence.
Remote access
SSH state and configuration match approved administration needs.
Persistence
Cron jobs, timers, and startup files match the final approved state.
Network
Interfaces, routes, listeners, and firewall policy still support required connectivity.
Evidence
Authentication, service, process, and schedule evidence was preserved before high-impact changes.
Linux final checklist
Finish only when security and required functionality both verify
The Linux mission was reviewed before major changes.
Approved users match the final account state.
Approved sudo-capable users match the final privilege state.
sudoers configuration validates successfully.
Sensitive file permissions and ownership were reviewed.
Unexpected world-writable or privileged files were investigated.
Required services remain running.
SSH state and configuration match the mission.
Cron jobs and systemd timers were reviewed.
Suspicious processes were investigated before containment.
Listening sockets and active connections were mapped to processes.
Firewall state supports required services without unnecessary exposure.
Authentication and system logs were reviewed.
Every major remediation was verified.
The change log records what changed, why, and the result.