Linux System Administation #1

1. Abstract
2. Terminology
3. What is Where in Your Linux Machine
4. Currently Running Linux
5. Proper Config of Grub
6. References
7. End

1 Abstract

These are items that you, as security student, must know at a bare minimum. Read the man page on the commands, before trying them out. Most of them need to be run as root. You can use the sudo prefix, or set aside a root-dedicated terminal, with a distinctly different appearance, where you have logged in as root.

2 Terminology

Commands are programs or script; read up on man file.

3 What is Where in Your Linux Machine

3.1 Hardware

Commands that report on what your machine has. Should remain unchanged unless you added/removed hardware items.
blkid
lshw
lsusb
dmidecode
https://www.pugetsystems.com/labs/support-software/Linux-hardware-identification-tools---now-with-more-GUI-1104/ But, in this course, we much prefer command line usage, not GUI.

3.2 Commands

Commands that report on what is installed, currently in use or not. Should remain unchanged unless you updated the installation.
cat /etc/issue
find /etc -name *mod*
ls -alR /boot
more /boot/config-*
more /boot/abi-* " Linux kernel and GNU C Library define the Linux API. After compilation, the binaries offer an ABI; keeping this ABI stable over a long time is important for ISVs. In computer software, an application binary interface (ABI) is an interface between two binary program modules; often, one of these modules is a library or operating system facility, and the other is a program that is being run by a user."
which init
ls -l /sbin/init

3.3 Where are the Programs and Scripts?

ls -l /bin /sbin /usr /usr/bin /usr/bin /usr/local/bin | wc -l

3.4 /dev

ls -l /dev
Major and minor numbers; ex: major 8, minor 1, block device
```
brw-rw---- 1 root disk 8, 1 Sep  6 20:09 /dev/sda1
```

3.5 Abstract Devices

ls -l /dev/random /dev/urandom /dev/zero /dev/null
Devices are also organized based on their function and usage.
=ls -l /dev/fuse /dev/kmsg
-ls -l /dev/loop*=
ls -l /dev/block/
find /dev/ -name *by*

4 Currently Running Linux

4.1 File Volumes and Swap

cat /etc/fstab /etc/exports /etc/samba/smb.conf
df -Th

4.2 Kernel

cat /proc/cmdline
modprobe(8), insmod(8), lsmod(8), modinfo(8) depmod(8, rmmod(8) Volume# 8
cat /proc/meminfo

4.3 User Accounts

ls -l /etc/passwd /etc/shadow /etc/group /etc/sudoers

4.4 /proc

Proc is a psuedo-file system. These are not real files sitting on the HDDs. OS presents its inner settings constructed as files in this directory. There are occasional discrepancies: Even after reporting the size as 0, cat will display size able content.
cat /proc/version related to uname -a
cat /proc/1/cmdline
ls -ld /proc/1/*
cat /proc/mounts
cat /proc/vmstat
cat /proc/interrupts

4.5 Installed Distributions on Your HDDs

/boot/grub/grub.cfg

5 Proper Config of Grub

5.1 Configure the Initial Grub Installation

5.2 Devious Grub

Replacing Grub Files: Easy if we have "console" access.
Replacing Grub Files: Easy if we have remote root access while Linux is running.

5.3 Secure Config of Grub

https://help.ubuntu.com/community/Grub2/Passwords The least you want to do.
We assumed that you already secured UEFI / BIOS and TPM.
TPM is beyond the scope of this course. https://trustedcomputinggroup.org/resource/trusted-platform-module-tpm-summary/

6 References

https://help.ubuntu.com/community/Grub2/Passwords Required Reading
https://help.ubuntu.com/lts/serverguide/user-management.html.en Required Reading
https://wiki.ubuntu.com/UEFI/SecureBoot Recommended Reading
https://wiki.gentoo.org/wiki/Security_Handbook/Bootloader_security Recommended Reading