CyberPatriot Resources · Resource 04

Linux: Ubuntu & Mint

Use official Ubuntu, Linux Mint, systemd, and manual-page references to understand users, privilege, permissions, services, logs, remote access, firewalling, and evidence.

Linux administration can change a large amount of system state with a small command. Check scope, dependencies, and side effects before making broad changes.

Linux resource rule

Understand the command before running the command

Use documentation whenever you are uncertain about syntax, scope, dependencies, or reversibility.

Official references

Ubuntu Server Documentation

Canonical's official reference for Ubuntu Server administration, services, networking, storage, security, and troubleshooting.

Open reference →

Ubuntu Security Documentation

Official guidance covering Ubuntu security features, hardening concepts, firewalling, updates, and access controls.

Open reference →

Ubuntu Firewall Documentation

Reference material for UFW and the Linux firewall technologies underneath it.

Open reference →

Ubuntu Manpages

Searchable manual pages for commands, configuration files, utilities, and system interfaces.

Open reference →

Linux Mint User Guide

Linux Mint documentation for system operation, administration, packages, troubleshooting, and Mint-specific behavior.

Open reference →

systemd Manuals

Primary documentation for services, units, timers, dependencies, logging, and systemd administration.

Open reference →

What to study

Users & Groups

Understand /etc/passwd, /etc/shadow, and /etc/group.

Use getent to inspect users and groups.

Distinguish normal users from system and service accounts.

Review sudo access before changing privilege.

Permissions

Understand owner, group, and other permission bits.

Know the difference between chmod and chown.

Treat recursive permission changes as high risk.

Investigate world-writable files in context.

Services

Use systemctl to inspect services and startup state.

Review unit files and overrides when behavior is unexpected.

Understand dependencies before disabling unfamiliar services.

Verify required applications after service changes.

Logs & Evidence

Use journalctl for systemd-managed logs.

Review relevant files under /var/log.

Correlate authentication, service, process, and network evidence.

Keep system and timestamp context with findings.

SSH & Remote Access

Confirm whether SSH is required by the competition scenario.

Review sshd service state and configuration.

Check authentication settings and listening exposure.

Verify approved remote access after any change.

Firewall & Networking

Use ip and ss to understand network state.

Use UFW when it is the intended firewall interface.

Remember that UFW is a frontend for Linux packet filtering.

Verify required connectivity after firewall changes.

Observation command reference

id

Show user identity and group membership.

getent passwd

Review account entries.

getent group

Review groups and membership.

sudo -l

Show allowed sudo privileges for the current user.

ps aux

Review running processes.

pstree -ap

View parent-child process relationships.

systemctl --type=service

Review systemd service units.

systemctl status NAME

Inspect one service.

journalctl -u NAME

Review logs for one systemd unit.

ss -tulpn

Review listening TCP and UDP sockets.

ip addr

Review interface addressing.

ip route

Review routing state.

ufw status verbose

Review UFW status and rules.

stat FILE

Review file metadata.

find

Locate files using ownership, permissions, time, path, and other attributes.

Important Linux paths

/etc/passwd

User-account definitions and user IDs.

/etc/shadow

Protected password and account-aging information.

/etc/group

Group definitions and membership.

/etc/sudoers

Primary sudo policy configuration.

/etc/sudoers.d/

Additional sudo policy files.

/etc/ssh/sshd_config

OpenSSH server configuration on many Linux systems.

/etc/systemd/system/

Local systemd units and overrides.

/etc/cron.*

System scheduled-task locations.

/var/log/

Traditional service and operating-system logs.

Using references during competition work

An account looks unauthorized

Compare the account with the approved-user list.

Review UID, groups, shell, home directory, and privilege.

Determine whether it is a user, system account, or service account.

Preserve useful authentication evidence.

Make only the justified change and verify required access.

A service looks suspicious

Identify the service, executable, startup state, and listener.

Check whether required functions depend on it.

Review journal and configuration evidence.

Do not disable it only because the name is unfamiliar.

Verify mission functionality after any change.

Permissions look too open

Record the current owner, group, and permission mode.

Determine the intended purpose of the object.

Check whether an application depends on the existing permissions.

Avoid broad recursive chmod or chown changes.

Test the affected service or application afterward.

SSH exposure looks wrong

Confirm whether SSH is required.

Check sshd service and listening state.

Review authentication-related configuration.

Review firewall exposure.

Test the approved remote-access path after changes.

Weak habit vs better habit

Weak habit

Delete unfamiliar users immediately.

Better habit

Classify the identity, compare it with the scenario, and check privilege and dependencies first.

Weak habit

Use chmod -R to fix permissions quickly.

Better habit

Change only the specific file or directory whose intended permissions are understood.

Weak habit

Disable every unfamiliar service.

Better habit

Inspect the service, process, listener, dependencies, logs, and mission purpose first.

Weak habit

Restart when the system behaves strangely.

Better habit

Collect process, service, log, configuration, and network evidence before considering a reboot.

Weak habit

Disable SSH because remote access is dangerous.

Better habit

Confirm mission requirements and secure only the exposure or authentication settings justified by evidence.

Weak habit

Run a remembered command without checking it.

Better habit

Use the man page or official documentation when the command's scope or side effects are uncertain.

Linux resource checklist

Use official Ubuntu, Mint, systemd, and man-page references first.

Classify accounts before changing or removing them.

Review sudo and group membership when evaluating privilege.

Avoid broad recursive chmod and chown operations.

Understand service purpose and dependencies before disabling it.

Use journalctl and appropriate log files to support conclusions.

Preserve evidence before removing suspicious persistence.

Confirm whether SSH is required before changing remote access.

Map listeners to owning processes and services.

Review UFW or the system's intended firewall carefully.

Verify required services and network access after changes.

Let the competition scenario determine what must remain functional.

← Resources CyberPatriot Hub

← Previous Resource Next Resource →