CHAPTER 3

Basic Commands

Linux commands are programs created to perform a specific task. Use the man command (short for manual) to
obtain documentation about commands. As an example, man ls provides documentation about the ls command
from the user manual.

Because commands are programs stored on the disk, when a user types a command, the shell must find it on the
disk before it can be executed. The shell will look for user-typed commands in specific directories and attempt to
execute them. The list of directories checked by the shell is called the path. The path contains many directories
commonly used to store commands. If a command is not in the path, the user must specify its location or the
shell will not be able to find it. Users can easily add directories to the path, if necessary.

To invoke a command via the shell, simply type its name. The shell will try to find it in the system path and
execute it.

Figures 1 and 2 shows a list of some basic Linux commands and their functions.

Note: The text here assumes the user has the proper permissions to execute the command. File permissions in
Linux is covered later in this chapter.
Service Configuration Files

In Linux, services are managed using configuration files. Common options are port number, location of the
hosted resources, and client authorization details. When the service starts, it looks for its configuration files, loads
them into memory, and adjusts itself according to the settings in the files. Configuration file modifications often
require restarting the service before the changes take effect.

Because services often require superuser privileges to run, service configuration files often require superuser
privileges for editing.

Figure 1 shows a portion of the configuration file for Nginx, a lightweight web server for Linux.

Figure 2 shows the configuration file for the network time protocol, NTP.

Figure 3 shows the configuration file for Snort, a Linux-based intrusion detection system (IDS).

There is no rule for a configuration file format; it is the choice of the service’s developer. However, the option =
value format is often used. For example, in Figure 3, variable ipvar is configured with several options. The first
option, HOME_NET, has the value 209.165.200.224/27.

Note: You may have to scroll down in Figure 3 to see this example.

Monitoring Service Logs

Log files are the records that a computer stores to keep track of important events. Kernel, services and
applications events are all recorded in log files. It is very important for an administrator to periodically review the
logs of a computer to keep it healthy. By monitoring Linux log files, an administrator gains a clear picture of the
computer’s performance, security status, and any underlying issues. Log file analysis allows an administrator to
guard against upcoming issues before they occur.

In Linux, log files can be categorized as:

 Application logs

 Event logs
  Service logs

 System logs

Some logs contain information about daemons that are running in the Linux system. A daemon is a background
process that runs without the need for user interaction. For example, the System Security Services Daemon
(SSSD) manages remote access and authentication for single sign-on capabilities. Below are a few popular Linux
log files and their functions:

 /var/log/messages – This directory contains generic computer activity logs. It is mainly used to store
informational and non-critical system messages. In Debian-based computers, /var/log/syslog directory
serves the same purpose.

 /var/log/auth.log - This file stores all authentication-related events in Debian and Ubuntu computers.
Anything involving the user authorization mechanism can be found in this file.

 /var/log/secure - This directory is used by RedHat and CentOS computers instead of /var/log/auth.log. It
also tracks sudo logins, SSH logins, and other errors logged by SSSD.

 /var/log/boot.log - This file stores boot-related information and messages logged during the computer
startup process.

 /var/log/dmesg - This directory contains kernel ring buffer messages. Information related to hardware
devices and their drivers is recorded here. It is very important because, due to their low-level nature,
logging systems such as syslog are not running when these events take place and therefore, are often
unavailable to the administrator in real-time.

 /var/log/kern.log - This file contains information logged by the kernel.

 /var/log/cron - Cron is a service used to schedule automated tasks in Linux and this directory stores its
events. Whenever a scheduled task (also called a cron job) runs, all its relevant information including
execution status and error messages are stored here.

 /var/log/mysqld.log or /var/log/mysql.log - This is the MySQL log file. All debug, failure and success
messages related to the mysqld process and mysqld_safe daemon are logged here. RedHat, CentOS and
Fedora stores MySQL logs under /var/log/mysqld.log, while Debian and Ubuntu maintain the log in
/var/log/mysql.log file.

The figure shows a portion of /var/log/sysloglog file. Each line represents a logged event. The timestamps at the
beginning of the lines mark the moment the event took place.
The Linux GUI

Although an operating system does not require a GUI to function, GUIs are considered more user-friendly than
the CLI. The Linux GUI as a whole can be easily replaced by the user. As a result of the large number of Linux
distributions, this chapter focuses on Ubuntu when covering Linux because it is a very popular and user-friendly
distribution.

Ubuntu Linux uses Unity as its default GUI. Unity’s goal is to make Ubuntu even more user-friendly. The main UI
components of Unity include:

 Top Menu Bar - This multipurpose menu bar contains the currently running application. It includes the
maximize, minimize, and exit buttons of the application in focus, as well as the system toggles including
settings, logout, and shutdown, clock, and other notifications.

 Launcher – This is a dock on the left side of the screen that serves as the application launcher and
switcher. Click to launch an application and when the application is running, click again to switch between
running applications. If more than one instance of an application is running, Launcher will display all
instances.

 Quicklist - Right-click any application hosted on the Launcher to access a short list of tasks the application
can perform.

 Dash Search Box - This holds the Search tool and a list of recently used applications. Dash includes
Lenses at the bottom of the Dash area which allow the user to fine-tune Dash search results. To access
Dash, click the Ubuntu button on the top of the Launcher.

 System and Notification Menu - Many important functions are located in the indicator menu, located at
the top right corner of the screen. Use the indicator menu to switch users, shut down your computer,
control the volume level, or change network settings.

The figure shows a breakdown of the Ubuntu Unity Desktop.

Click here to experience Unity desktop in your web browser.

Installing and Running Applications on a Linux Host

Many end-user applications are complex programs written in compiled languages. To aid in the installation
process, Linux often includes programs called package managers. A package is the term used to refer to a
program and all its supported files. By using a package manager to install a package, all the necessary files are
placed in the correct file system location.

There are several package managers. For this course, we will use the Advanced Packaging Tool (apt) package
manager. The figure shows the output of a few apt commands. The apt-get update command is used to fetch
the package list from the package repository and update the local package database. The apt-get
upgrade command is used to update all currently installed packages to their latest versions.

Keeping the System Up To Date

Also known as patches, OS updates are released periodically by OS companies to address any known
vulnerabilities in their operating system. While companies have update schedules, the release of unscheduled
OS updates can happen when a major vulnerability is found in the OS code. Modern operating systems will alert
the user when updates are available for download and installation but the user can check for updates at any time.

To update the local package metadata database using the CLI, use the apt-get update command.

To upgrade all the currently installed packages using the CLI, use the apt-get upgrade command.

To manually check and install updates on Linux using the GUI, follow the path:
Click Dash Search Box > type software updater > click the Software Updater icon, as shown in the figure.

Rootkit Check

A rootkit is a set of software tools designed to increase a user’s privileges, or grant access to portions of the
software that should not normally be allowed. Rootkits are also often used to secure a backdoor to a
compromised computer.

The installation of a rootkit can be automated (done as part of an infection) or an attacker can manually install it
after compromising a computer. A rootkit is destructive because it changes kernel code and its modules,
changing the most fundamental operations of the OS itself. With such a deep level of compromise, rootkits can
hide the intrusion, remove any installation tracks, and even tamper with troubleshooting and diagnostics tools so
that their output now hides the presence of the rootkit. While a few Linux vulnerabilities through history have
allowed rootkit installation via regular user accounts, the vast majority of rootkit compromises require root or
administrator access.

Because the very nature of the computer is compromised, rootkit detection can be very difficult. Typical detection
methods often include booting the computer from trusted media such as a diagnostics operating system live CD.
The compromised drive is mounted and, from the trusted system toolset, trusted diagnostic tools can be
launched to inspect the compromised file system. Inspection methods include behavioral-based methods,
signature scanning, difference scanning, and memory dump analysis.

Rootkit removal can be complicated and often impossible, especially in cases where the rootkit resides in the
kernel; re-installation of the operating system is usually the only real solution to the problem. Firmware rootkits
usually require hardware replacement.

chkrootkit is a popular Linux-based program designed to check the computer for known rootkits. It is a shell script
that uses common Linux tools such as strings and grep to compare the signatures of core programs. It also looks
for discrepancies as it traverses the /proc file system comparing the signatures found there with the output of the
ps. Click herefor more information about chkrootkit.

While helpful, keep in mind that programs to check for rootkits are not 100% reliable.

The figure shows the output of chkrootkit on an Ubuntu Linux.

Piping Commands

Although command line tools are usually designed to perform a specific, well-defined task, many commands can
be combined to perform more complex tasks by a technique known as piping. Named after its defining character,
the pipe (|), piping consists of chaining commands together, feeding the output of one command into the input of
another.

For example, the ls command is used to display all the files and directories of a given directory. The grep
command compares searches through a file or text looking for the specified string. If found, grep displays the
entire contents of the folder where the string was found. The two commands, ls and grep, can be piped together
to filter out the output of ls, as shown in the figure with the ls -l | grep nimda command.
CHAPTER 4

Views of the Network

Networks come in all sizes. They can range from simple networks consisting of two computers to networks
connecting millions of devices. Click the plus signs (+) in the figure to read about networks of different sizes.

Home office networks and small office networks are often set up by individuals that work from a home or a
remote office and need to connect to a corporate network or other centralized resources. Additionally, many self-
employed entrepreneurs use home office and small office networks to advertise and sell products, order supplies
and communicate with customers.

In businesses and large organizations, networks can be used on an even broader scale to provide consolidation,
storage, and access to information on network servers. Networks also allow for rapid communication such as
email, instant messaging, and collaboration among employees. In addition to internal benefits, many
organizations use their networks to provide products and services to customers through their connection to the
Internet.

The Internet is the largest network in existence. In fact, the term Internet means a ‘network of networks’. The
Internet is literally a collection of interconnected private and public networks.

A Typical Session: Student

A typical network user at school, at home, or in the office, will normally use some type of computing device to
establish many connections with network servers. Those servers could be located in the same room or around
the world. Let’s look at a few typical network communication sessions.
Terry is a high school student whose school has recently started a “bring your own device” (BYOD) program.
Students are encouraged to use their cell phones or other devices such as tablets or laptops to access learning
resources. Terry has just been given an assignment in language arts class to research the effects of World War I
on the literature and art of the time. She enters the search terms she has chosen into a search engine app that
she has opened on her cell phone.

Terry has connected her phone to the school Wi-Fi network. Her search is submitted from her phone to the
school network wirelessly. Before her search can be sent, the data must be addressed so that it can find its way
back to Terry. Her search terms are then represented as a string of binary data that has been encoded into radio
waves. Her search string is then converted to electrical signals that travel on the school’s wired network until they
reach the place at which the school’s network connects to the Internet Service Provider’s (ISP) network. A
combination of technologies take Terry’s search to the search engine website.

For example, Terry’s data flows with the data of thousands of other users along a fiber-optic network that
connects Terry’s ISP with the several other ISPs, including the ISP that is used by the search engine company.
Eventually, Terry’s search string enters the search engine company’s website and is processed by its powerful
servers. The results are then encoded and addressed to Terry’s school and her device.

All of these transitions and connections happen in a fraction of a second, and Terry has started on her path to
learning about her subject.

A Typical Session: Gamer

Michelle loves computer games. She has a powerful gaming console that she uses to play games against other
players, watch movies, and play music. Michelle connects her game console directly to her network with a copper
network cable.

Michelle’s network, like many home networks, connects to an ISP using a router and a cable modem. These
devices allow Michelle’s home network to connect to a cable TV network that belongs to Michelle’s ISP. The
cable wires for Michelle’s neighborhood all connect to a central point on a telephone pole and then connect to a
fiber-optic network. This fiber-optic network connects many neighborhoods that are served by Michelle’s ISP.

All those fiber-optic cables connect to telecommunications services that provide access to the high-capacity
connections. These connections allow thousands of users in homes, government offices, and businesses to
connect Internet destinations around the world.

Michelle has connected her game console to a company that hosts a very popular online game. Michelle is
registered with the company, and its servers keep track of Michelle’s scores, experiences, and game assets.
Michelle’s actions in her game become data that is sent to the gamer network. Michelle’s moves are broken up to
groups of binary data that each consist of a string of zeros and ones. Information that identifies Michelle, the
game she is playing, and Michelle’s network location are added to the game data. The pieces of data that
represent Michelle’s game play are sent at high speed to the game provider’s network. The results are returned
to Michelle in the form of graphics and sounds.

All of this happens so quickly that Michelle can compete with hundreds of other gamers in real-time.

A Typical Session: Surgeon

Dr. Ismael Awad is an oncologist who performs surgery on cancer patients. He frequently needs to consult with
radiologists and other specialists on patient cases. The hospital that Dr. Awad works for subscribes to a special
service called a cloud. The cloud allows medical data, including patient x-rays and MRIs to be stored in a central
location that is accessed over the Internet. In this way, the hospital does not need to manage paper patient
records and X-ray films.

When a patient has an X-ray taken, the image is digitized as computer data. The X-ray is then prepared by
hospital computers to be sent to the medical cloud service. Because security is very important when working with
medical data, the hospital uses network services that encrypt the image data and patient information. This
encrypted data cannot be intercepted and read as it travels across the Internet to the cloud service provider’s
data centers. The data is addressed so that it can be routed to the cloud provider’s data center to reach the
correct services that provide storage and retrieval of high-resolution digital images.

Dr. Awad and the patient’s care team can connect to this special service, meet with other doctors in audio
conferences and discuss patient records to decide on the best treatment that can be provided to the patient. Dr.
Awad can work with specialists from diverse locations to view the medical images and other patient data and
discuss the case.

All of this interaction is digital and takes place using networked services that are provided by the medical cloud
service.