Linux · Lesson 18
Linux Final Review Checklist
Finish the Linux image with a structured final review covering identity, authentication, permissions, software, services, networking, persistence, logs, verification, and team handoff.
Final review is not the time for random cleanup. Use the scenario, current evidence, and the full defensive workflow to find high-impact problems, verify required functionality, and leave the image stable.
Final Lesson Snapshot
Learning objectives
Finish the image without breaking what the scenario requires
Run a complete final Linux review without undoing required services, accounts, or competition functionality.
Use one organized checklist that covers identity, authentication, permissions, packages, services, networking, persistence, logs, and evidence.
Prioritize high-impact findings before low-risk cleanup during the final review window.
Verify every important change with direct evidence instead of assuming that a successful command means the system is healthy.
Record unresolved questions, required exceptions, and final system state so the team can hand off confidently.
Finish with a repeatable Ubuntu and Linux Mint competition-day sequence that is fast, evidence-based, and safe.
Core idea
Final review is verification, not another rebuild
Re-check the system from the scenario outward. Confirm required access and services first, then clean up only the risks you can explain and verify.
Late-round discipline
The closer you are to the end, the more controlled changes should become
Broad changes can erase progress or break required functionality. Favor targeted fixes with known rollback and direct verification.
Final review principles
Six rules for the last pass
Re-read the scenario
The scenario is still the source of truth. Required users, services, applications, roles, and network functions override generic hardening rules.
Verify, do not assume
A command returning without an error does not prove the required function works. Recheck the actual user, service, network, and application behavior.
Prefer high-value findings
Final review time should focus first on unauthorized administrators, broken authentication, exposed services, suspicious persistence, and missing required protections.
Preserve evidence
Do not erase suspicious files, logs, startup entries, or account evidence simply to make the image look cleaner.
Avoid late broad changes
Large recursive permission changes, package removals, firewall resets, or network rewrites are especially risky late in a round.
Leave the image stable
The best final state is secure, functional, explainable, and verified. A technically hardened but broken image is not a successful result.
Rapid snapshot
Capture the final system state first
cat /etc/os-releaseConfirm the distribution and release before final distro-specific checks.
hostnamectlConfirm hostname, operating system, kernel, architecture, and virtualization context.
uptimeConfirm current uptime and load before final changes.
whoShow currently logged-in users.
systemctl --failedIdentify failed systemd units that may indicate broken required functionality.
ss -tulpnReview listening network sockets and owning processes.
ip -br addrSummarize interface and address state.
ip routeConfirm active routing and default gateway.
sudo ufw status verboseReview the final UFW state and default policy.
journalctl -p warning..alert -bReview warning-or-higher events from the current boot.
Identity
Final user and privilege review
Authorized users
getent passwdVerify
Every interactive account has a known scenario role or documented reason to remain.
Administrative groups
getent group sudo; getent group admVerify
Only users who require the privilege remain in sensitive groups.
Per-user privilege
id username; groups username; sudo -l -U usernameVerify
The user's effective privilege matches the scenario.
UID 0
awk -F: '$3 == 0 {print $1 ":" $3 ":" $7}' /etc/passwdVerify
Every UID 0 account is expected and justified.
Login shells
getent passwdVerify
Service and system accounts do not have interactive shells unless required.
Last login
lastlogVerify
Unexpected recent login activity has been investigated and documented.
Authentication
Final password, PAM, SSH, and key review
Password state
passwd -S usernameVerify
Required human accounts have the intended password state.
Password aging
chage -l usernameVerify
Aging and expiration settings match the scenario and do not lock out required users.
PAM policy
grep -RInE 'pam_pwquality|pam_pwhistory|pam_faillock|pam_tally' /etc/pam.d /etc/security 2>/dev/nullVerify
Authentication controls are present only where supported and required by the image.
SSH authentication
sudo sshd -t && sudo sshd -T | grep -Ei 'passwordauthentication|pubkeyauthentication|permitrootlogin|allowusers|allowgroups|maxauthtries'Verify
Effective SSH authentication policy preserves required access while limiting unnecessary exposure.
Authorized keys
find /home -maxdepth 3 -type f -name authorized_keys -ls 2>/dev/nullVerify
Known authorized keys remain and unexplained keys have been investigated.
Authentication logs
sudo grep -iE 'failed|invalid|accepted|sudo|authentication' /var/log/auth.log | tail -n 100Verify
Unexpected successful authentication or repeated suspicious patterns have been reviewed.
Permissions
Final ownership and access review
Sensitive config ownership
stat /etc/passwd /etc/shadow /etc/group /etc/gshadowVerify
Ownership and mode are appropriate for account databases.
Sudoers
sudo visudo -cVerify
Sudo policy parses successfully and no unintended broad privilege remains.
SSH directory
sudo ls -la /etc/sshVerify
Server configuration and host-key material have appropriate ownership and access.
User SSH paths
find /home -maxdepth 3 \( -name .ssh -o -name authorized_keys \) -ls 2>/dev/nullVerify
Home SSH paths belong to the intended users and are not broadly writable.
World-writable files
sudo find /home /etc -xdev -type f -perm -0002 -ls 2>/dev/nullVerify
Any world-writable file in reviewed high-value paths is intentional and justified.
Setuid files
sudo find / -xdev -type f -perm -4000 -ls 2>/dev/nullVerify
Unexpected setuid binaries have been traced to package ownership and purpose.
Packages
Final software and repository review
Installed packages
apt list --installedVerify
Known required software remains installed and high-risk unfamiliar software has been reviewed.
Manual packages
apt-mark showmanualVerify
Unexpected manually installed packages have been investigated.
Repositories
apt-cache policyVerify
Official and required repositories remain, and unexplained sources have been reviewed.
Upgrades
apt list --upgradableVerify
Important pending updates are understood and handled according to competition requirements.
Snap
snap listVerify
Snap packages are reviewed where Snap is installed.
Flatpak
flatpak listVerify
Flatpak applications are reviewed where Flatpak is installed.
Services
Final service and listener review
Running services
systemctl --type=service --state=runningVerify
Every important running service has a known purpose or has been investigated.
Enabled services
systemctl list-unit-files --type=service --state=enabledVerify
Unnecessary enabled services have been reviewed without disabling scenario-required services.
Failed units
systemctl --failedVerify
No required service remains failed.
Service evidence
systemctl status service-name; journalctl -u service-name --since todayVerify
Required services are active, stable, and free of unresolved configuration failures.
Unit overrides
systemctl cat service-nameVerify
Unexpected drop-ins or overrides have been investigated.
Listener mapping
ss -tulpnVerify
Listening ports match required services and documented exceptions.
Networking
Final interface, route, DNS, firewall, and SSH review
Interfaces
ip -br addrVerify
Required interfaces are up and have expected addresses.
Routes
ip route; ip -6 routeVerify
Required IPv4 and IPv6 routes remain intact.
DNS
resolvectl status; readlink -f /etc/resolv.conf; getent hosts example.comVerify
Resolver configuration works and required names resolve.
Firewall
sudo ufw status numberedVerify
Rules are narrow, required services remain allowed, and unnecessary exposure is removed.
Listening sockets
ss -tulpnVerify
Listeners bind only where expected, including IPv4 and IPv6.
Remote access
systemctl status ssh; sudo sshd -tVerify
SSH is secure and still available when required.
Persistence
Final scheduled and startup persistence review
Cron
sudo cat /etc/crontab; sudo ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthlyVerify
Scheduled jobs are required, legitimate, or documented for further review.
User crontabs
sudo crontab -l; crontab -lVerify
Root and current-user scheduled entries are understood.
systemd persistence
systemctl list-unit-files --type=service; systemctl list-timers --allVerify
Unexpected services and timers have been investigated.
Shell startup
grep -RInE 'curl|wget|bash -c|sh -c|/tmp/|/dev/shm/' ~/.bashrc ~/.profile /etc/profile /etc/profile.d /etc/bash.bashrc 2>/dev/nullVerify
Suspicious shell startup behavior has been preserved and addressed.
Desktop autostart
find ~/.config/autostart /etc/xdg/autostart -maxdepth 1 -type f -name '*.desktop' -ls 2>/dev/nullVerify
Unfamiliar graphical startup entries have been traced to real executables and package purpose.
Temporary paths
sudo find /tmp /var/tmp /dev/shm -maxdepth 2 -type f -ls 2>/dev/nullVerify
Suspicious executables or scripts in temporary locations have been investigated without deleting evidence prematurely.
Logs & evidence
Final evidence review
Boot warnings
journalctl -p warning..alert -bVerify
High-priority events have been reviewed and required services are not failing silently.
Authentication
sudo grep -iE 'failed|invalid|accepted|sudo|authentication' /var/log/auth.log | tail -n 100Verify
Unexpected successful sessions or privilege events have been investigated.
Package history
sudo tail -n 100 /var/log/apt/history.log; sudo tail -n 100 /var/log/dpkg.logVerify
Recent package changes align with authorized actions.
Service logs
journalctl -u service-name --since todayVerify
Required services are stable after hardening changes.
Boot history
journalctl --list-bootsVerify
Unexpected reboots or missing journal history have been reviewed.
Cron evidence
sudo grep -i CRON /var/log/syslog | tail -n 50Verify
Important scheduled tasks are behaving as expected where syslog records them.
Final priority buckets
Decide what still deserves time
Protect access and required functionality
Required administrator account, SSH, networking, DNS, web service, competition application, required user accounts.
Fix or restore immediately if broken.
Remove confirmed high-impact risk
Unauthorized admin, known malicious persistence, exposed unnecessary remote service, unsafe sudo rule, confirmed rogue repository.
Preserve evidence, remediate narrowly, then verify.
Resolve important misconfiguration
Weak permissions, failed required service, broken update source, unnecessary broad firewall rule, insecure SSH setting.
Correct if the fix is understood and low-risk.
Investigate unresolved unknowns
Unfamiliar package, odd process, unknown startup entry, unexpected route, unexplained account.
Gather evidence and classify before changing.
Cosmetic or low-value cleanup
Minor naming inconsistencies, harmless unused files, non-security desktop preferences.
Leave for last or skip if time is limited.
Change log
Record the important changes another teammate may need to understand
Time
When the change or observation occurred.
Area
User, service, package, firewall, network, permission, persistence, or other category.
Finding
What evidence showed before the change.
Action
The exact controlled change performed.
Verification
How the team proved the intended result.
Rollback
Backup, original state, or recovery method if the change must be reversed.
Keep the log short but useful
Focus on changes that affected access, services, security policy, persistence, packages, networking, or evidence. The log should help a teammate understand what changed without reading every terminal command.
Functional verification
Verify the real workflow, not just the configuration
SSH required
sudo sshd -tsystemctl status sshss -tulpn | grep -E '(:22\b|sshd)'sudo ufw status verboseauthorized client login testjournalctl -u ssh --since '10 minutes ago'HTTPS required
systemctl status web-serviceservice-specific config testss -tulpn | grep ':443'sudo ufw status verboseauthorized client HTTPS testjournalctl -u web-service --since '10 minutes ago'DNS required
resolvectl statusreadlink -f /etc/resolv.confgetent hosts required-nameip routerequired application name-resolution testUser privilege changed
id usernamegroups usernamesudo -l -U usernamepasswd -S usernameauthorized login or sudo test when requiredPersistence removed
confirm startup or cron entry is disabledconfirm suspicious process is not recreatedreview relevant journal/auth/cron logsverify required application startup still worksStop and think
Final-round actions that deserve an extra check
You are about to use chmod -R or chown -R
Stop and confirm the exact path, application ownership model, and whether recursion is truly necessary.
You are about to run ufw reset
Stop. Rebuild only if you have a complete required-service plan and explicit reason. Late-round firewall reset is high risk.
You are about to remove a package with many dependencies
Stop and inspect the removal plan before confirming.
You are about to restart networking over SSH
Stop and confirm an out-of-band recovery path or safer test method.
You are about to delete suspicious evidence
Stop. Preserve file contents, metadata, logs, and references before destructive cleanup.
You are changing something because it looks unfamiliar
Stop and classify it using owner, package, service, process, path, logs, and scenario context.
Ubuntu and Mint final branch
Keep the shared workflow, then run the distro-specific checks
Ubuntu
Confirm Ubuntu repositories are expected and healthy.
Review Snap only if snapd is present.
Confirm GNOME or other Ubuntu desktop components remain functional if the image is graphical.
Inspect netplan when it is actually used by the image.
Linux Mint
Confirm Mint repositories are expected and healthy.
Do not treat Mint-specific packages as unwanted by default.
Confirm Cinnamon, MATE, or Xfce components required by the desktop remain functional.
Do not install Snap merely to make Mint resemble Ubuntu.
Final defensive lab
Perform a complete fictional final review
Read the fictional final-round scenario: SSH and HTTPS are required, Morgan is the only administrator, Avery and Riley are standard users, nightly backups must continue, and the image is Linux Mint Cinnamon.
Capture a rapid system snapshot: distro, hostname, uptime, logged-in users, failed units, listeners, interfaces, routes, firewall state, and current-boot warnings.
Run the identity and authentication review. Confirm Morgan's admin role, Avery and Riley's standard-user roles, password state, sudo access, SSH policy, and authorized keys.
Review packages, repositories, services, listeners, networking, cron, startup files, desktop autostart, and logs using the final checklist.
Place each unresolved item into P1 through P5 priority buckets. Do not make changes based on unfamiliarity alone.
Apply only the justified final changes, recording time, finding, action, verification, and rollback for each important modification.
Run final functional verification: SSH, HTTPS, DNS, firewall, users, scheduled backup, desktop login, update sources, required services, and post-change logs.
Finish with a handoff note listing confirmed secure areas, required exceptions, unresolved low-risk questions, and the commands used for final verification.
Master Linux checklist
Final confirmation before handoff
I re-read the scenario and confirmed required users, services, applications, and network functions.
I confirmed the distribution, release, and desktop environment.
I reviewed interactive users, administrative groups, UID 0 accounts, login shells, and last-login information.
I reviewed password state, aging, PAM-related policy, SSH authentication, and authorized keys.
I checked ownership and permissions on high-value account, SSH, sudo, and configuration paths.
I reviewed installed packages, manual packages, repositories, upgrades, Snap, and Flatpak where present.
I reviewed running, enabled, failed, and network-exposed services.
I reviewed interfaces, routes, DNS, IPv4, IPv6, firewall rules, SSH, and required remote access.
I reviewed cron, timers, systemd units, shell startup, desktop autostart, and temporary-path persistence.
I reviewed authentication, package, service, boot, and scheduled-task logs.
I preserved evidence before destructive remediation.
I avoided broad late-round changes such as recursive chmod/chown, firewall reset, or blind package removal.
I verified required SSH, web, DNS, login, package, desktop, and scheduled-job workflows after changes.
I recorded important findings, actions, verification, and rollback information.
I left the image stable, functional, and ready for team handoff.
Final handoff
What your teammate should know
Required services and access that were verified
Important changes made during the round
Required exceptions that should not be undone
Suspicious findings that were preserved or remediated
Low-risk unknowns that remain unresolved
Rollback notes or backups that still exist
Final commands used to verify the image
Reflection
Final reasoning check
Question 1
Why should the scenario be reread during final review instead of only at the beginning?
Question 2
Which findings belong in P1 and P2, and why should they come before cosmetic cleanup?
Question 3
Why is a successful systemctl command not enough to prove a service is healthy?
Question 4
What evidence should be preserved before removing suspicious persistence?
Question 5
Why are broad permission, firewall, package, and networking changes especially risky late in a round?
Question 6
What should a final handoff note contain so another teammate can trust the image state?
Linux pathway complete
You now have a complete defensive Linux workflow from scenario reading through accounts, permissions, software, services, networking, persistence, evidence, distro differences, and final verification.