Socratic Linux

Can you list the number of CPUs?
  • lscpu
  • nproc
  • cat /proc/cpuinfo | grep -i proc
  • python3 -c "import multiprocessing as mp; print(mp.cpu_count())"
Can you tell me the speed in MHz?
  • dmesg | grep -i mhz
  • lscpu
  • cat /proc/cpuinfo
Can you tell me the manufacturer of the chip?
  • lscpu
  • cat /proc/cpuinfo
  • lshw | grep -i intel
Can you tell the architecture of this chip?
  • lscpu
  • uname -m
Can you tell me if this system is physical or virtual?
  • lshw -C system
  • dmidecode -s system-manufacturer
  • virt-what
  • lspci #look for something like QEMU
  • systemd-detect-virt
Can you spin up the CPU to high load for 3 minutes?
  • stress -c 4 --timeout 180
  • for i in $(seq 100); do dd if=/dev/urandom bs=1024k count=5000 | bzip2 -9 > /dev/null & done
  • openssl speed -multi $(nproc)

Memory Topics

Can you tell me how much RAM we have?
  • free -m
  • cat /proc/meminfo
  • htop
  • neofetch
Can you tell me how much RAM we have used?
  • free -m
  • htop
Can you tell me how much swap we have?
  • free -m
Can you free all of the cached memory?
  • echo 3 > /proc/sys/vm/drop_caches
Can you generate high memory load for 3 minutes?
  • stress --vm 4 --timeout 180s

Filesystem Topics

Can you show all of the used space of the / (root) partition?
  • df -h /
  • lsblk -f
Can you show all of the inodes of the / (root) partition?
  • df -i /
Can you show the used space of the directory you're in?
  • du -sh .
Can you show all processes in the directory you're in?
  • lsof .
Check long listing of files, do you know the permissions?
  • ls -ld #Directory or file
Can you create 3 hard links to a file?
  • Yes - ln /tmp/testfile /tmp/otherfile1
Can you hard link to a file across filesystem boudary?
  • No
Cat out the file that defines mount points in the system?
  • cat /etc/fstab
  • cat /etc/mtab
Speed tests of writes and reads
  • for i in $(seq 5); do echo "I am writing $i file"; time dd if=/dev/zero of=bigfile$i bs=4096k count=250; done
  • for i in $(seq 5); do echo "I am reading $i file"; time dd if=bigfile$i of=/dev/null; done
Can you show all the interfaces?
  • ip a
  • ip addr
  • ifconfig
  • ip -br a
Can you show that the interface is connected physically?
  • ethtool enp1s0
Can you determine default route?
  • ip r
  • route
Can you ping the default gateway 3 times?
  • ping -c3 172.30.1.1
Can you determine the MTU of the network with ping?
  • ip addr #To see MTU
  • ping -c1 -s 1500 -M do www.yahoo.com
Can you identify all your IPv4 and IPv6 networks? IPv4? IPv6? Both?
  • ip addr - IPv4 - enp1s0 docker0 - IPv6 - Calico - Both - lo flannel.1
Can you list your open ports?
  • netstat -ntulp
  • ss -ntulp
  • lsof -i :22
Can you prove that your DNS is working?
  • ping anything by name outside of network.
  • nslookup
  • host
  • dig
What file do we edit to change service to port number mapping?
  • /etc/services
Can we connect to another server and test for an open port?
  • telnet
  • nc -vz node01 22
  • timeout 3 nc node01 22
Can you connect to another server with ssh and show debug 3 levels?
  • ssh -vvv node01 'uptime'
Can we verify that nothing is blocking us to www.google.com?
  • curl www.google.com
Can you copy a file from this server to another and back?
  • scp <local file> remotenode:/<filesystem> #Send
  • scp remotenode:/<filesystem> <local file> #Pull
Can we capture all the packets between interfaces and put them in file?
  • tcpdump ip host controlplane and node01 -c 10000 -i enp1s0 -w /tmp/wireshark1.pcap
Can we test the speed between two systems?
  • iperf3 - One node will function as the server - iperf3 -c - The other will test speed to it - iperf3 <nameofserver>
Can we show all the hops between us and google?
  • traceroute www.google.com
Can you show all the TCP/IP errors on an interface over one minute?
  • sar -n TCP,ETCP 60
  • ifconfig
Can you list the Doom port?
  • grep -i doom /etc/services
Can you read from port 22 and see the banner information of the connection?
  • nc 127.0.0.1 22

Disk Topics

How do you check how many disks you have?
  • lsblk
  • lsblk -f
  • fdisk -l
  • ls -l /dev/disk/by-*
  • blkid
How do you check how many disk partitions you have?
  • lsblk
  • lsblk -f
  • fdisl -l | grep -i vd
How do you check which filesystems are on which partitions?
  • lsblk
  • lsblk -f #more information
  • mount
  • findmnt
  • mount | grep -iE "ext4|xfs"
Can you check for partitions that aren't even mounted for FS Types?
  • lsblk -f
Can you check disk I/O over time?
  • bwm-ng -i disk
  • iostat -d 1 #One second iterations forever
  • iostat -d 1 10 #10 one second iterations
  • iostat -xz #Only things that have activity
  • iotop #By process I/O to disk
Can you verify disk read and write speed?
  • for i in $(seq 5); do echo "I am writing $i file"; time dd if=/dev/zero of=bigfile$i bs=4096k count=250; done
  • for i in $(seq 5); do echo "I am reading $i file"; time dd if=bigfile$i of=/dev/null; done

Security Topics

What users have logged into the system in the last 24 hours?
  • last | more
  • last | tac
  • lastlog | grep -v Never
Can you tell what pid is listening on port 22?
  • ss -ntulp | grep 22
  • ps -ef | grep -i sshd
  • systemctl status sshd
  • lsof -i :22
Can you show how systemd started sshd?
  • systemctl status ssh
  • systemctl cat ssh
  • systemd-analyze critical-chain ssh.service
Can you list the kernel modules?
  • lsmod
Can you verify that a file has not changed in the last 3 days?
  • stat /etc/crontab
  • Hashing function? #Tripwire
Can you verify the hash of a file before and after you push it to another server?
  • md5sum /etc/crontab; scp /etc/crontab node01:/tmp/crontab; ssh node01 'md5sum /tmp/crontab'
Can you encrypt a file with vi?
  • vi -x /tmp/somefile
For any user can you determine their sudo permissions?
  • sudo -l -U scott
For all users can you list a count of what default shells they have?
  • cat /etc/passwd | awk -F: '{print $7}' | sort | uniq -c
  • cat /etc/passwd | awk -F: '{print $NF}' | sort | uniq -c
Can you verify an individual user's limits of open files?
  • ulimit -a -u scott
Where do you change user limits?
  • vi /etc/security/limits.conf

General System

Can you show me how the system was booted by grub?
  • dmesg | head
  • cat /proc/cmdline
  • journalctl
Can you tell me the running kernel version?
  • uname -r
  • dmesg -k | head
  • cat /proc/version
  • cat /proc/cmdline
Can you tell me how many older versions of the kernel are available?
  • ls -l /boot/vm*
  • apt list --installed | grep linux-image
Can you show that the ssh(d) server is running?
  • systemctl status ssh
  • ps -aux | grep ssh
  • ss -ntulp | grep -i ssh
  • lsof -i : 22
  • nc 127.0.0.1 22
Can you show how the SSH(d) process was started? What's the parent process?
  • ps faux | grep -i ssh
  • systemctl status ssh
  • pstree -s -p <pid>
  • ps -afg
Can you edit the file that changes which kernel the system boots to?
  • view /etc/grub/grub.conf
Can you tell me the version of Linux you're on?
  • cat /etc/*release
  • lsb_release -a
Can you describe the 7 fields of the /etc/passwd?
  • Yes
    • Colon Delimeted Username : Password : UID : Primary Group GUID : Comment : Home : Default Shell
Can you show me all the unique shells in /etc/passwd
  • cat /etc/passwd | awk -F: '{print $7}' | sort | uniq -c
Can we set one variable that is inherited by child processes and one that is not, and then prove it?
  • dino=rawr #not inherited
  • export dino2=rawr2 #is inherited
Can you set a process to run every 5 minutes on a server?
  • */5 * * * * 'echo "I love Linux" | wall'
What is the user's home directory? What is Root's home directory?
  • Users: /home/<username>
  • Root: /root
Can you show all the aliases your user has available?
  • alias
Can you create or remove an alias?
  • unalias
  • alias
Can you tell if the user has a password set?
  • grep scott /etc/shadow
  • chage -l scott
Can you create an alias and make it permanent?
  • .bashrc or /etc/profile.d
Do you know where the default user home directory files populate from?
  • /etc/skel
Can you set a script that automatically runs on any user login?
  • /etc/profile.d/
Can you check current users?
  • cat /etc/passwd
Do you know your primary and secondary groups?
  • id <username>

Bash Scripting

Can you touch a file with today's date in the filename?
  • touch file.date +%F``
  • touch file.$(date +%F%T)
Can you create 100 files named file?
  • for i in $(seq 100); do touch file$i; done
  • touch file{1..100}
  • count=1;while [ $count -lt 100 ]; do touch file$count; count=$((count+=1)); done
Can you show the pid of the shell you're in?
  • echo $$
Can you create files 1-199 skipping even numbers?
  • for i in seq 1 2 199; do echo "I am checking the number $i"; touch file$i; done
Can you create a variable of one data point?
  • var1=100
Can you loop forever watching uptime every 2 seconds
  • watch uptime
  • while true; do uptime; sleep 2; done
Can you make your system count to 100?
  • seq 100
  • seq 1 100
  • count=1;while [ $count -le 100 ]; do echo "$count"; count=$((count+=1)); done
  • for ((i=1;i<=100;i++)); do echo "I am counting $i"; done
  • awk '{for (i=1;i<=100;++i)print i}' <<< ""
  • perl -e '$count=0; while($count <= 100){print "$count\n"; $count++;}'
  • perl -E 'for ($i=1; $i<=100; $i++){print "$i \n";}'
  • perl -E 'for ($i=1; $i<=100; $i++){say $i;}'
Can you loop over lists/files?
  • for server in controlplane node01; do echo "I am working on server $server"; done
  • for server in $(cat servers); do echo "I am working on server $server"; done
  • while read -r server; do echo $server; done < servers
Can you connect to two servers and show uptime in a file?
  • cat script.sh
    #!/bin/bash
    ####################################################
    # Purpose:
    # Date:
    # Name:
    # Revisions:
    ####################################################
    startTime=`date`
    sleep 10
    endTime=`date`
    echo "The start was $startTime and the end was $endTime"
    
Can you test a variable against a know value?
  • if [ $shell == "/bin/bash" ]
  • if [ $shell = "/bin/bash" ]

Software Packages

Can you show all the packaages that have SSL in their name?
  • dpkg -l | awk '{print $2}' | grep -i ssl
  • dpkg -l | gawk '/ssl/{print $2}'
Can you show when the system software was last modified?
  • cat /var/log/apt/history.log
  • cat /var/log/dpkg.log | grep <tool>
Can you verify that you have a software called cowsay? If not, install it?
  • dpkg -l | grep -i cowsay
  • apt install cowsay
Can we see if we have container software? Can we check for local images?
  • docker images
  • podman images
Can run a container? Can we verify it's running? Can we verify the image?
  • docker run -p 8080:80 -d nginx
  • docker ps
  • docker images to see images