Read the scenario
Identify authorized users, required services, applications, networking needs, remote access, restrictions, and forensic questions before changing the system.
CyberPatriot Training Hub
Linux: Ubuntu & Mint
Learn how to review and harden Ubuntu and Linux Mint competition images using evidence, safe command-line inspection, controlled changes, and continuous verification.
This pathway teaches one transferable Linux security method. Ubuntu and Mint differences are explained only when they actually affect the tool, path, package, service, or decision.
Linux Scope
Lessons18
Core workflow5 stages
DistributionsUbuntu + Mint
Training styleDefensive
Safety boundary
Train the skill, not the live answer
Examples and labs use fictional Linux systems and authorized practice environments. The goal is to understand defensive administration, evidence, and verification rather than publish restricted answers for active competition images.
Main question
How do you secure Linux without breaking what the scenario requires?
Linux gives administrators enormous control. Strong competition work uses that control carefully: inspect first, understand dependencies, make narrow changes, preserve evidence, and verify required functionality afterward.
Linux workflow
Five stages for controlled Linux defense
Inventory the image
Inspect users, groups, sudo access, packages, services, processes, permissions, network exposure, scheduled tasks, and logs before broad remediation.
Classify findings
Separate clear high-confidence issues from findings that need more evidence, coordination, or dependency review.
Make controlled changes
Use the least disruptive fix that addresses the confirmed issue while preserving required Linux functionality and forensic evidence.
Verify the result
Re-check the configuration and prove that authorized users, required services, networking, applications, and security controls still work.
Complete pathway
Linux Lessons
Lessons move from Linux fundamentals and identity into permissions, software, services, networking, persistence, evidence, command-line administration, distribution differences, and final review.
Lesson 01Linux
Linux Competition Workflow
Focus
Build a safe Linux competition workflow around scenario review, baseline inspection, evidence, controlled remediation, and verification.
Defensive lab
Review a fictional Linux image, identify required users and services, and organize findings into Do Now, Investigate, Coordinate, and Verify.
Open Lesson →
Lesson 02Linux
Linux Filesystem & Important Paths
Focus
Understand the Linux filesystem hierarchy and the locations commonly used for users, services, logs, configuration, software, temporary data, and startup behavior.
Defensive lab
Map important files and directories on a fictional Ubuntu system without changing them.
Open Lesson →
Lesson 03Linux
Users, Groups & Sudo Privilege
Focus
Review local users, groups, administrative privilege, sudo access, account shells, home directories, and scenario-authorized identities.
Defensive lab
Compare a fictional account inventory with scenario requirements and identify the least-disruptive privilege corrections.
Open Lesson →
Lesson 04Linux
Passwords, Authentication & Account Policies
Focus
Review password aging, authentication behavior, locked accounts, PAM-related concepts, and account-policy decisions without forcing one configuration everywhere.
Defensive lab
Evaluate fictional account-policy evidence and determine what should be verified, changed, or left alone.
Open Lesson →
Lesson 05Linux
File Ownership & Permissions
Focus
Use ownership, groups, rwx permissions, special bits, and least privilege to protect files without breaking required applications or services.
Defensive lab
Correct a fictional permission problem while preserving authorized access and service dependencies.
Open Lesson →
Lesson 06Linux
Packages, Repositories & Software Review
Focus
Inventory installed packages, understand repositories and package sources, identify unnecessary software, and plan safe updates or removal.
Defensive lab
Classify a fictional package inventory as required, unnecessary, suspicious, or investigate.
Open Lesson →
Lesson 07Linux
Services & systemd
Focus
Review running services, enabled units, service dependencies, startup behavior, and systemd evidence before stopping or disabling anything.
Defensive lab
Analyze fictional service states and preserve required web, SSH, logging, and networking functions.
Open Lesson →
Lesson 08Linux
Processes & Resource Review
Focus
Inspect running processes, parent-child relationships, users, resource usage, executable paths, and command lines without assuming unfamiliar means malicious.
Defensive lab
Investigate a fictional process list and identify which processes need more evidence.
Open Lesson →
Lesson 09Linux
SSH & Remote Access Security
Focus
Review SSH configuration, authorized access, authentication methods, listening exposure, service state, and firewall dependencies.
Defensive lab
Secure a fictional required SSH service while preserving authorized administrative access.
Open Lesson →
Lesson 10Linux
UFW Firewall & Network Exposure
Focus
Understand firewall status, default policy, allowed services, ports, interfaces, and required network exposure using UFW and supporting tools.
Defensive lab
Reduce unnecessary exposure on a fictional Linux server without blocking required SSH or application traffic.
Open Lesson →
Lesson 11Linux
Networking, Interfaces & DNS
Focus
Review addresses, interfaces, routes, listening ports, DNS configuration, name resolution, and required connectivity using modern Linux tools.
Defensive lab
Trace a fictional connectivity problem and verify the intended network state after a controlled change.
Open Lesson →
Lesson 12Linux
Cron Jobs & Scheduled Persistence
Focus
Inspect user and system cron jobs, timers, scheduled commands, execution context, and persistence clues before remediation.
Defensive lab
Preserve and classify a fictional scheduled command that runs with elevated privilege.
Open Lesson →
Lesson 13Linux
Startup, Shell Profiles & Persistence Review
Focus
Review shell startup files, autostart locations, system startup mechanisms, user-level persistence, and unusual automatic execution.
Defensive lab
Investigate fictional startup entries and separate legitimate configuration from suspicious persistence.
Open Lesson →
Lesson 14Linux
Logs, journalctl & System Evidence
Focus
Use journalctl, authentication logs, service logs, package history, and other evidence to build timelines and troubleshoot security-relevant events.
Defensive lab
Correlate fictional login, sudo, service, and system events around a known incident window.
Open Lesson →
Lesson 15Linux
Configuration Files & Secure Editing
Focus
Read and edit Linux configuration safely, preserve originals, understand comments and syntax, validate changes, and avoid destructive bulk edits.
Defensive lab
Review a fictional service configuration, make one controlled change, and verify the service remains functional.
Open Lesson →
Lesson 16Linux
Linux Defensive Command Line
Focus
Use inspection-first Linux commands for users, groups, permissions, processes, services, networking, packages, logs, and verification.
Defensive lab
Build a repeatable read-only Linux inventory and use it to verify one controlled remediation.
Open Lesson →
Lesson 17Linux
Ubuntu vs Linux Mint Competition Differences
Focus
Understand where Ubuntu and Linux Mint behave similarly and where desktop tools, defaults, packages, services, or configuration paths may differ.
Defensive lab
Compare two fictional systems and identify which security checks are universal and which need distribution-specific verification.
Open Lesson →
Lesson 18Linux
Linux Final Review Checklist
Focus
Bring identity, permissions, packages, services, network exposure, persistence, logs, evidence, and required functionality into one final verified Linux state.
Defensive lab
Complete a fictional end-of-round Linux review and document unresolved investigate items.
Open Lesson →
Priority zone
Identity & Privilege
Users and groups
sudo access
Locked or disabled accounts
Shells and home directories
Password and authentication policy
Priority zone
System & Software
Packages and repositories
Services and systemd
Processes
Startup behavior
Configuration files
Priority zone
Access & Networking
Ownership and permissions
SSH
UFW firewall
Interfaces and routes
Listening ports and DNS
Priority zone
Evidence & Persistence
cron and timers
Shell startup files
journalctl and logs
Authentication evidence
Change verification
Ubuntu and Mint
One Linux pathway, differences only where they matter
The pathway teaches transferable Linux reasoning first. When a graphical tool, package, default service, configuration location, or distribution behavior differs, the lesson will call it out explicitly instead of pretending both systems are identical.
Shared Linux foundation
Ubuntu and Linux Mint share many core commands, package-management concepts, filesystem conventions, permissions, systemd behavior, and security practices.
Desktop differences
Graphical tools and menu locations may differ because Ubuntu and Mint can use different desktop environments and utilities.
Package and default differences
A package, service, application, or default setting may exist on one image and not another. Verify the actual system instead of assuming.
Teach the common method first
Most lessons focus on Linux concepts and terminal-based inspection that transfer across both distributions, then call out differences where they matter.
Linux evidence preview
Fictional practice environment
01
Host: linux-practice
02
Distribution: Ubuntu-based training image
03
Authorized administrator: Morgan
04
Required standard users: Avery and Riley
05
Required service: SSH for Morgan from the training network
06
Required application: internal web service
07
Forensic clue: unknown root-owned scheduled command
08
Important boundary: preserve logs and task details before remediation
Linux principles
Six rules to carry through the pathway
Scenario before checklist
Required users, services, applications, and network paths must survive every security change.
Inspect before editing
Linux makes powerful changes easy from the command line. Read the current state before using commands that modify it.
Unknown is not malicious
An unfamiliar user, process, package, service, cron job, or file should be investigated before removal or disabling.
Permissions have dependencies
Ownership and mode changes can break applications, services, scripts, package management, or user workflows.
Evidence before cleanup
Preserve logs, command lines, file metadata, task details, account state, and configuration evidence before remediation.
Verify from the user and service perspective
A secure-looking configuration is not complete until required users and services still function as intended.
Start here
Lesson 01 — Linux Competition Workflow
Begin by learning how to read the Linux scenario, establish a baseline, classify findings, protect required functionality, and verify every meaningful change.