Linux for Cybersecurity Beginners: Filesystem, Commands, Permissions and Logs

Online manuals are also available at man7.org.

Be careful with rm -r. It deletes a directory and everything inside it with no confirmation. Double-check the path, and never combine it with sudo unless you are certain.

Pipes: the | symbol sends the output of one command into the next. Redirects: > writes output to a file (overwriting it) and >> appends. Chaining small commands is the secret of fast log analysis.

cut -d: -f1 /etc/passwd | sort | head -n 5

Principle of least privilege: work as a normal user and use sudo only for the single command that needs it. Staying logged in as root makes mistakes and attacks far more damaging.

Run ls -l and you will see lines like this:

-rwxr-xr-- 1 maya analysts 482 Oct  2 09:10 backup.sh

Numeric method: add the numbers for each group. rwx = 4+2+1 = 7, r-x = 4+0+1 = 5, r-- = 4, rw- = 6, --- = 0. Three digits give owner, group and others.

A line in /etc/passwd looks like this, with fields split by colons:

analyst1:x:1002:1002::/home/analyst1:/bin/bash

Fields: username, password placeholder (x means the hash is in shadow), UID, GID, optional comment, home directory, login shell.

sudo useradd -m -s /bin/bash analyst1     # create user with a home folder
sudo passwd analyst1                      # set a password
sudo groupadd soc-team                    # create a group
sudo usermod -aG soc-team analyst1        # add user to the group
id analyst1                               # confirm membership
groups analyst1                           # list the user's groups
sudo usermod -L analyst1                  # lock the account
sudo userdel -r analyst1                  # delete user and home folder

• Important: in usermod -aG, the -a means append. Without it, the user is removed from every other supplementary group.
• On Ubuntu and Kali, members of the sudo group can use sudo. Other distributions may use a group called wheel.
• Group changes apply at the next login.
• Security habits: one account per person, strong passwords, remove accounts when people leave, and review the members of the sudo group regularly.

This is invented data using reserved example addresses. Each line holds a timestamp, host name, the program that wrote it, and a message.

Oct  2 09:14:01 labvm sshd[1201]: Failed password for invalid user admin from 203.0.113.45 port 52114 ssh2
Oct  2 09:14:05 labvm sshd[1203]: Failed password for invalid user admin from 203.0.113.45 port 52120 ssh2
Oct  2 09:14:09 labvm sshd[1205]: Failed password for root from 203.0.113.45 port 52131 ssh2
Oct  2 09:20:44 labvm sshd[1230]: Accepted password for maya from 198.51.100.7 port 40022 ssh2
Oct  2 09:31:12 labvm sudo:     maya : TTY=pts/0 ; PWD=/home/maya ; USER=root ; COMMAND=/usr/bin/apt update
Oct  2 09:45:30 labvm sshd[1260]: Failed password for maya from 198.51.100.7 port 40100 ssh2
Oct  2 10:02:18 labvm sshd[1288]: Failed password for invalid user test from 192.0.2.99 port 33000 ssh2
Oct  2 10:02:22 labvm sshd[1290]: Failed password for invalid user test from 192.0.2.99 port 33004 ssh2

Step 1: Count failures.

grep -c "Failed password" sample.log

Answer: 6.

Step 2: Pull out the source addresses. The -o option prints only the matched part, and the pattern describes four groups of digits:

grep "Failed password" sample.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}'

Step 3: Count per address. Sort first so identical lines sit together, then count them, then sort by count:

grep "Failed password" sample.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -nr

Expected output:

      3 203.0.113.45
      2 192.0.2.99
      1 198.51.100.7

Step 4: Interpret. Address 203.0.113.45 failed three times in eight seconds, including attempts for admin and root. That speed and the invalid user names point to automated guessing. Address 198.51.100.7 logged in successfully, then failed once, which looks like a normal typo. The signal is the pattern, not the single line.

Step 5: Report. Write what you saw, the time window, the counts and your recommended action (for example, block the address, disable password login for SSH, or enable rate limiting).

Spotting a successful login right after repeated failures from the same address is the pattern to look for. It may mean the guessing worked.

sudo grep "Failed password" /var/log/auth.log | tail -n 20
sudo tail -f /var/log/auth.log
sudo journalctl -u ssh --since "1 hour ago"
last -n 10
sudo lastb -n 10

• tail -f shows new lines as they arrive. Press Ctrl+C to stop.
• The SSH service unit is called ssh on Debian-based systems and sshd on many others.
• last shows recent logins, and lastb shows failed ones if the system records them.
• Rotated logs are renamed (for example auth.log.1) and older ones may be compressed. Use zgrep to search compressed files.

pwd
ls -lah

You should see sample.log. Hidden items start with a dot.

mkdir -p reports/2026/october

-p creates every missing parent. Check with ls -R reports.

cp sample.log reports/2026/october/auth-copy.log
ls -l reports/2026/october

Always work on a copy of evidence, never the original.

head -n 3 sample.log
tail -n 2 sample.log

find ~/linux-practice -name "*.log"

Two results: sample.log and the copy from Task 3.

echo 'echo "hello"' > report.sh
chmod 755 report.sh
./report.sh

It prints hello. The ./ tells the shell to run the file in the current directory.

touch private.txt
chmod u=rw,go= private.txt
ls -l private.txt

Result: -rw-------. The empty value after go= clears all group and others permissions.

750. Owner: read, write, execute. Group: read and execute. Others: nothing.

sudo useradd -m -s /bin/bash analyst1
id analyst1
grep analyst1 /etc/passwd

Set a password with sudo passwd analyst1 if you want to log in as that user.

sudo groupadd soc-team
sudo usermod -aG soc-team analyst1
id analyst1

The output should list soc-team among the groups. Clean up when finished: sudo userdel -r analyst1 and sudo groupdel soc-team.

grep -c "Failed password" sample.log

Answer: 6.

grep -vn "Failed" sample.log

You should see line 4 (accepted login) and line 5 (sudo use).

grep "Failed password" sample.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -nr

Expected: 203.0.113.45 (3), 192.0.2.99 (2), 198.51.100.7 (1).

grep -c "invalid user" sample.log
grep "invalid user" sample.log | awk '{print $10}' | sort | uniq -c

Four attempts: admin twice and test twice. In these lines the user name is the tenth field, so $10 works. Field positions can differ between log formats, so always check a line first.

{ echo "Top failed-login source:"; grep "Failed password" sample.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -nr | head -n 1; echo "Total failed logins:"; grep -c "Failed password" sample.log; } > findings.txt
chmod 600 findings.txt
cat findings.txt
ls -l findings.txt

The file should show 203.0.113.45 with 3 attempts and a total of 6, with mode -rw-------. Findings often include sensitive details, so restrict access.