SECFND 9: Linux Flashcards
chmod
Modify file perms
chmod symbolic mode
Use a symbol to represent the access class and the access type you want to modify
“chmod u+r MyFile.txt”
Symbolic mode access class letters
U, G, O, A (a is default)
Symbolic mode operator symbols
+, -, =
Symbolic mode access type letters
R, W, X
Symbol to reset access type when using chmod
= (resets rather than changes)
First partition on first HDD
/dev/sda1
parted command
partition tool
gparted
graphical partition tool
fdisk
partition tool (MBR)
gdisk
partition tool
GPT
newer partition table type. More partitions and disk size.
ext2, ext3, ext4
Linux file systems
ISO 9660 and Juliet
File systems for optical media
/etc/fstab
A list of all devices previously mounted. uses UUID identifier
mount command
Mount a device
Boot loaders (2)
GRUB, LILO
BOOT_IMAGE
Part of boot loader. References Kernel and followed by root=partition
System V
Init process. Runs scripts one at a time
Systemd
Newer init process. Runs scripts parralel
Run levels
7 run levels (0-6) that contain scripts to start and stop daemons. Part of the init process (mostly System V)
/etc/inittab
Part of System V init
/proc/cmdline
Boot parameters processed by boot loader
Single user mode
Safe mode (never to be used for forensics.
Run level 1
Run level 1
Safe mode
shutdown -h
Halt the system
X11
GUI subsystem
TID
Thread ID
How do multi-threaded processes start
Main thread, then additional as needed. They run in parralel
PID after process fork
Parent takes child’s PID. Child gets PID 0
top command
real-time view of system information including system up time, process information, and resource utilization
TOP NICE value
19 to -20. Higher number is lower priority. Lower number is higher priority.
TOP S column
Process status
R: Running
S: Sleeping
Z: Zombie
PS command
lists processes that are associated with the user running the command
PS -f
Full output
PS -e
See processes for everyone
PS -fC sshd
See full info on processes associated with SSHD service
grep
Filter with wild cards and regular expressions
.*
Regex that means any. Same as good old *
LSOF command
Lists processes using certain files. Must be elevated to use (SUDO)
sudo lsof +D /var/log
Lists processes using files in a directory
sudo lsof -p 892
Lists files access by a process