Chapter 4 — Linux administration basics
Lesson map
Lesson 04 published. Map, example, EX010.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Files and permissions"]
N2["4.2 Packages and updates"]
N3["4.3 Services"]
N4["4.4 Working safely"]
N5["Logs on Linux"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX010"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Files and permissions"]
N2["4.2 Packages and updates"]
N3["4.3 Services"]
N4["4.4 Working safely"]
N5["Logs on Linux"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX010"]
[Learning outcomes]
|
v
[4.1 Files and permissions]
|
v
[4.2 Packages and updates]
|
v
[4.3 Services]
|
v
[4.4 Working safely]
|
v
[Logs on Linux]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX010]
Learning outcomes
You will (1) navigate and manage a Linux server; (2) manage packages and services; (3) read configuration safely.
4.1 Files and permissions
Linux organises everything under one directory tree. Each file has an owner, a group and permissions for reading, writing and executing. Configuration lives mostly under /etc. Tomás learns to read permissions with the ls command and to check who owns sensitive files, such as SSH configuration, which should be writable only by root.
On the trust's servers he checks that the SSH configuration file under /etc/ssh is owned by root and not writable by any group, and records the permissions alongside the date. A configuration file that an ordinary account can edit undoes every other setting in it, because that account could quietly re-enable root sign-in or password authentication.
4.2 Packages and updates
Linux distributions install software through package managers such as apt or dnf. The package manager also applies security updates. On the trust's Debian-based servers, Dev uses unattended-upgrades to install security updates automatically each night, and reviews the log weekly. Tomás learns to list pending updates without installing them, which is safe to do during his placement.
On a Debian-based server the command apt list --upgradable shows pending updates without changing anything, so Tomás can run it under his read-only sudo rights. He compares its output with the unattended-upgrades log to see whether the nightly job is really installing security updates, or whether something such as a held package has stopped it quietly.
4.3 Services
Programs that run in the background are services, managed by systemd. The systemctl command lists running and enabled services. Every running service is something to keep updated and configured, so unneeded ones should be disabled. NIST SP 800-123 recommends removing or disabling unnecessary services on servers.
On the trust's servers Tomás runs systemctl list-unit-files with the enabled state, a read-only command, and compares each enabled service with what the server is for. A service that nobody can explain is not stopped by him; it goes on a list for Dev, who checks whether anything depends on it before disabling it in a planned change.
4.4 Working safely
Tomás works on a test virtual machine first. On live servers he only reads, using his own account with limited sudo rights granted for viewing logs and configuration. Any change is agreed with Dev and made by Dev, with a note in the change log.
The test virtual machine runs the same Debian release as the trust's servers, so commands behave the same way there. Any command Tomás wants to run on a live server is first written in his notes with what it reads and why, and Dev agrees it beforehand. If a read-only command unexpectedly asks for confirmation or a password, he stops and asks Dev, because that usually means it would change something.
Logs on Linux
Linux servers record events in the systemd journal and in text files under /var/log. The journalctl command filters the journal by service, priority and time, so Tomás can list SSH sign-ins for the last day with a single read-only command instead of scrolling raw files. He learns three patterns: filter by unit to see one service, filter by time window to look around an event, and filter by priority to see only errors. He also checks how long the journal is kept on each server, because a server that keeps only a day of history cannot answer questions about last week. Retention is agreed with Dev and recorded in the server notes.
Worked example
On the test machine, Tomás lists enabled services and finds a mail transfer agent installed by default but unused; disabling it on the test machine shows nothing else depends on it, which he reports to Dev.
Synthetic case. Systems are synthetic.
Errors and limits
Copying commands from the internet onto live servers is risky; test first and understand each command.
Exercises
- EX010 — Config location. Where is most Linux system configuration stored, and who should be able to change it? Rubric: 3 = /etc, root only, with reason;; 2 = /etc;; 1 = wrong;; 0 = none.
- EX011 — Safe update check. Describe a safe way to see pending updates without installing them. Rubric: 3 = list upgradable packages read-only;; 2 = vague;; 1 = minimal attempt;; 0 = none.
- EX012 — Service review. Why disable unused services? Rubric: 3 = less to patch and configure, per SP 800-123;; 2 = less risk;; 1 = vague;; 0 = none.
Synthesis
A few Linux skills, reading permissions, packages and services, are enough to assess a server safely.
Continue studying — chapter 04 of 30
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →