Table of Contents

Linux Commands

This guide is designed to be a solution to frequently googled Linux information. It contains simplified commands for doing a series of tasks within a Linux/UNIX system. For extended information behind the commands themselves, please see the resource links below each category. Please note there may be references to information from a previous technology manager position; these references should be ignored.

Note: Many of the commands listed here require sudo/root access in order to work.

Keyboard Shortcuts

CTRL + C		stop/kill a bad command
CTRL + Z		pause/suspend a bad bash command (use "ps" and "kill" to kill)
CTRL + U		erase what you were typing (when backspace/esc just prints special characters)
CTRL + D		exit/logout
CTRL + L		clear the terminal
CTRL + ALT + Fn		switch screen (can switch between F1 to F6)
CTRL + R		search bash/command history

System

General

poweroff			# shutdown a linux system (needs sudo/root access)
reboot				# reboot a linux system (needs sudo/root access)
 
sudo !!				# repeat previous command as sudo
 
ssh SVR				# connect to a remote server through current server
ssh USR@SVR			# connect to a remote server with USR username
ssh SVR "command"		# connect to a remote server, run a command, then disconnect
 
ssh-keygen			# generate ssh public/private key pair
ssh-copy-id USR@SVR		# push ssh public key to remote server SVR under user USR
cat ~/.ssh/id_rsa.pub | ssh USR@SVR 'cat >> .ssh/authorized_keys'	# same as previous command
 
screen				# start a screen session
screen -r			# reconnect a screen session
				# CTRL + A, then D to disconnect a screen session
 
watch CMD			# repeat CMD command every 2 seconds
watch -d CMD			# repeat CMD command every 2 seconds and highlight the differences
watch -n 10 CMD			# repeat CMD command every 10 seconds
watch "CMD; CMD2"		# repeat CMD and CMD2 every 2 seconds
 
history				# view command history
history -c			# clear entire command history
history -d NUM			# delete command NUM from history (use "history" to get number)
!NUM				# run command NUM from history (use "history" to get number)
^STR^RPL			# in previous command, replace STR with RPL, then run modified command
 
uptime				# view uptime since last reboot
 
date				# view current date
timedatectl			# view expanded time/date
timedatectl list-timezones	# view all available timezones
timedatectl set-timezone TZN	# set timezone to TZN
 
which CMD			# find out the location of CMD command
 
wall TXT			# broadcast a message TXT to all connected users
write USR			# broadcast message to a specific user (type message, then press CTRL+D)
echo TXT | write USR		# alternate way to broadcast message TXT to a specific user USR

Hardware Info

cat /etc/issue			# get Linux distro version
cat /etc/*release		# get more detailed info on Linux version
lsb_release -a			# another way to get Linux distro info
uname -r			# get Linux kernel version
rpm -qa kernel			# list all Linux kernels
 
lscpu				# get cpu info (model, speed, etc)
cat /proc/cpuinfo		# get more detailed cpu info
 
free -m				# get memory info
cat /proc/meminfo		# get memory info
dmidecode --type memory		# get expanded memory info (how many slots, what's in each slot, etc)
lshw -class memory		# another way to get expanded memory info
 
lspci				# list all pci devices
lsusb				# list all usb devices
lsblk				# list all block devices (hard drives, cdrom, etc)
blkid				# get the UUID for all block devices
ethtool IFACE			# get hardware info on network interface IFACE (max speed, etc)
 
dmidecode | less		# dump all hardware information (vendor, serial numbers, etc) -- press 'q' to exit
lshw | less			# another way to dump all hardware info

Memory

swapoff -a -v			# turn swap file off (verbose)
swapon -a -v			# turn swap file on (verbose)
 
dd if=/dev/zero of=/SWAPFILE count=4096 bs=1MiB		# create a 4GB file called SWAPFILE
chmod 600 /SWAPFILE 					# set proper permissions on file SWAPFILE
mkswap /SWAPFILE					# convert file SWAPFILE to a swap file
swapon /SWAPFILE					# add file SWAPFILE to the swap filesystem

GPU

nvidia-smi			# NVIDIA System Management Interface program
nvidia-smi -h			# show help and options
nvidia-smi -L			# list all GPUs
nvidia-smi -q			# GPU info, including serial number
nvidia-smi topo -m		# get GPU topology (multi-gpu systems)
nvidia-smi mig -lgip		# get available MIG modes

BMC/IPMI

ipmitool -H IP -U USR -I lanplus CMD		# run command CMD for system IP with user USR (will ask for password)
ipmitool -H IP -U USR -P PASS -I lanplus CMD	# same as previous, but use password PASS (non-interactive)
 
ipmitool -H IP -U USR -I lanplus lan print	# print BMC configuration
ipmitool -H IP -U USR -I lanplus mc info	# get firmware information for BMC

Booting Up

efibootmgr -v				# view current EFI boot entries
efibootmgr -o 0000,0002			# change boot sequence to 0000, then 0002 (run prev command to make sense of this)
efibootmgr -b 2 -B			# remove boot entry 0002
 
# Disable/Enable the GUI/X11 in CentOS 7
systemctl get-default			# get default runlevel
systemctl list-units --type=target	# get list of valid runlevels
systemctl set-default LVL.target	# change default runlevel to LVL
 
# Install/Enable the GUI in AlmaLinux 8
yum group list				# show environment groups
yum groupinstall "Server with GUI"	# install GUI
systemctl set-default graphical.target	# set GUI as default (not needed if only remote GUI access is required)
reboot					# reboot the system
 
# Install Grub Customizer in Ubuntu -- For Changing Boot Order After Ubuntu is Installed
sudo add-apt-repository ppa:danielrichter2007/grub-customizer
sudo apt-get update
sudo apt-get install grub-customizer
 
grubby --default-kernel				# centos8: get full path of default boot kernel
grubby --default-index				# centos8: get index of default boot kernel
grubby --info=ALL				# centos8: get info on all boot entries
grubby --set-default-index=NUM			# centos8: set index NUM as default boot entry
grubby --set-default=KRN			# centos8: set full path KRN as default boot entry
 
awk -F\' '/menuentry / {print $2}' /boot/grub/grub.cfg	# ubuntu16: get all grub menu entries

Resources: Modify an EFI boot order using efibootmgr, How to Change GRUB Boot Order in Ubuntu, How to boot into Single User Mode in CentOS, Set Time and Date, Screen How To Guide, Boot Partition is Full, Install GUI on AlmaLinux

Software & Updates

RHEL/CentOS

yum update			# patch system by applying all updates
yum update PKG			# update the package PKG
yum update --exclude=PKG	# patch system, but exclude PKG (can also do wildcard: PKG*)
yum update --disablerepo=REPO	# patch system, but temporarily disable repository REPO (see 'yum repolist' for valid entries)
 
yum list updates		# show list of updated software (security fix)
yum list installed		# list all installed packages
yum list available		# list all available packages
yum list PKG			# search for package PKG
yum list *PKG*			# search for package with "PKG" in the name
 
yum repolist			# list all installed repositories
 
yum install PKG1 PKG2		# install package PKG1 and PKG2 (PKG2 is optional, or you can add more)
yum install PKG.rpm		# install local package PKG.rpm using YUM
yum remove PKG1 PKG2		# uninstall package PKG1 and PKG2 (PKG2 is optional, or you can add more)
yum whatprovides FILE		# display what package provides the file FILE
yum provides FILE		# same as "yum whatprovides FILE"
 
yum --enablerepo=extras install epel-release	# enables CentOS extra repos (used for installing open-vm-tools)
package-cleanup --oldkernels --count=2		# delete old kernels except for the last 2

Debian/Ubuntu

apt-get update			# get updated repositories for updating packages
apt-get upgrade			# actually perform the upgrade
 
apt list --installed		# list all installed packages
apt search PKG			# find all available packages with keyword PKG
 
apt-get install PKG		# install the package PKG
apt-get remove PKG		# uninstall the package PKG, keep settings data
apt-get remove purge PKG	# uninstall the package PKG including settings data
apt-mark hold PKG		# keep package PKG from updating when apt-get update/upgrade is run
apt-mark unhold PKG		# un-holds the package; will now be updated with everything else

Convert from CentOS 8 to CentOS 8 Stream

dnf install centos-release-stream -y		# install stream repository
dnf swap centos-{linux,stream}-repos		# replace centos with centos-stream
dnf install epel-release			# install new epel
dnf config-manager --set-enabled epel		# enable new epel
dnf config-manager --set-enabled powertools	# enable powertools
dnf distro-sync					# sync and perform upgrade

Resources: How To yum Command, apt-get Cheat Sheet, Convert CentOS 8 to Stream

Users

General Info

id -u USR			# check if a user exists
id USR				# get extended info about USR
 
who				# see who is logged onto the system
who -u				# same as who, but also gives PID for users
whoami				# see who you are logged in as
 
last				# print login history of all users for the past month
last -wad			# print login history with sorted full user/domain, ip/dns
last USR			# print login history of USR for the past month
lastb				# print bad login history
lastb -wad			# print bad login history with sorted full user/domain, ip/dns
 
cut -d: -f1 /etc/passwd		# List All Users
cut -d: -f1 /etc/group		# List All User Groups
groups				# List Current User Groups
grep 'GRP' /etc/group		# List All Users In Group GRP
getent passwd			# List All User Details
listusers			# List All Users -- Solaris/SunOS Only!

Sudo/Administrator

su				# promote yourself to super user
su USR				# switch to user USR (must be root, does not require that user's password)
sudo su				# same as above
sudo su -			# same as above, but keeps environment variables
visudo				# open vi editor to modify sudo/admin access for users
 
# To grant someone sudo access to a particular file/command, open sudoers via visudo and type
#  username ALL=/path/to/command.sh
 
wall -n MSG			# broadcast MSG to all users of the server
wall -n < FILE			# broadcast contents of FILE to all users of the server
echo "TXT" | write USR XXX/N	# send TXT to the terminal of USR (use who to find the XXX/N part, e.g.: pts/1)

Resources: Configuring SUDO Access, Creating a Restricted SSH User for SSH Tunneling Only, How to Use VISUDO, Understanding /etc/passwd File Format, Using LAST

Create/Modify/Delete

useradd USR				# create new user
useradd -m USR				# create new user, create home directory if none
useradd -d DIR -s SHL -G GRP1,GRP2 USR	# create user USR, set home directory DIR, set login shell SHL, add to groups GRP1, GRP2
 
userdel -r USR				# delete user and remove user folder
passwd USR				# reset the password of a specific user
passwd -l USR				# lock a user acct from use
passwd -u USR				# unlock a user acct
passwd -d root				# delete password of root account
 
groupadd GRP				# create a group named GRP
groupdel GRP				# delete a group named GRP
usermod -a -G GRP USR			# add existing user USR to group GRP
gpasswd -d USR GRP			# remove user USR from group GRP
usermod -c "INFO" USR			# modify the comment INFO for user USR (name, email)
usermod -s SHLL USR			# modify user USR to use shell SHLL (e.g: "usermod -s /bin/bash username")

Resources: How to Add New Linux User Account, Remove User Account in Linux, Usermod Examples

Permissions

stat -c "%a %n" FILE	# get current file/directory permissions octal number for FILE
 
chmod			# change file/directory permissions
chmod a+r FILE		# add READ permissions for ALL users for FILE
chmod +x FILE		# add EXECUTE permissions for current user for FILE
			# other options: a=all, o=owner, g=group, +x=add execute, -r=remove read, +w=add write
chmod 644 FILE		# default permissions for files
chmod 755 DIR		# default permissions for folders
 
chown			# change file/directory ownership
chown USR DIR		# change DIR ownership to USR, keep original group
chown USR:GRP FILE	# change FILE ownership to USR, change group ownership to GRP
chown -R USR:GRP DIR	# recursively change DIR ownership to USR and GRP, also affects files
 
find DIR -type d -exec chmod 755 {} \;		# set all folders in DIR to 755
find DIR -type f -exec chmod 644 {} \;		# set all files in DIR to 644

SELinux

getenforce		# get current SELinux mode
setenforce 0		# set SELinux to Permissive mode (still reports, does not survive between reboots)
setenforce 1		# set SELinux to Enforcing mode (default)
 
getsebool BOOLEAN	# get value of SELinux boolean
setsebool -P BOOLEAN	# set value of SELinux boolean permanently
 
restorecon -Rv DIR	# restore SELinux context for DIR (useful for apache/httpd "403 forbidden" errors)
 
/etc/selinux/config	# selinux configuration (permanently set permissive or disable modes)
 
# this is a more aggressive SELinux setter; it looks at logs and sets everything within the log to be permissible
# useful when restorecon does not work, but turning off selinux does
grep httpd /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

Processes

top			# see a list of running processes (like taskmon), also kill processes
top -U USR		# see a list of running processes for USR
			# q		exit application
			# z		toggle color on/off
			# 1		toggle individual cpu on/off
			# m		toggle memory info
			# W		save current display for future sessions
			# o		filter list (example: "PID=XXX" where XXX is a PID)
 
w			# show only the top part of "top"
htop			# more detailed version of top (must be installed)
ps			# see a list of processes on the system (simpler than top)
ps -al			# see a more detailed list of processes
ps -u USR		# see a list of running processes for USR
 
iotop			# monitor disk IO per process (must be installed)
 
jobs			# see a list of running/paused jobs
bg			# continue a recently paused process in the background, shows job id when successful
fg			# bring the last backrounded process to the foreground
 
nice -NN CMD		# run command CMD with priority NN (default priority is 0)
nice --NN CMD		# run command CMD with priority -NN (must be root)
renice NN -p PID	# change priority of process PID to NN
 
kill %###		# kill job with number ###, for when you stopped jobs with CTRL+Z
kill -15 ###		# kill the process with PID ### (use first, less harsh)
kill -9 ###		# kill the process with PID ### (use second, more harsh)
killall -u USR		# kill all processes from a user (good for ending hanging login sessions)
 
disown %###		# disown a process, process keeps running even on disconnect, NO WAY TO UNDO!

Services

service SVC status		# check if a service is running -- older method (CentOS 6)
service --status-all		# check status of all services -- older method (CentOS 6)
chkconfig --list		# check service configuration -- older method (CentOS 6)
 
systemctl enable SVC		# enable a service (start on boot)
systemctl disable SVC		# disable a service
 
systemctl start SVC		# start the service SVC
systemctl stop SVC		# stop the service SVC
systemctl restart SVC		# restart the service SVC
 
systemctl status SVC		# check if a service is running
systemctl status -l SVC		# same as above but gets status without truncation
systemctl is-active SVC		# check if a service is active (enabled & running)
systemctl list-unit-files	# check status of all services

Networking

General

ping						# ping a computer
ibping						# same as ping but for InfiniBand interfaces
 
ifconfig					# show network configuration
ifconfig -a | grep ether | awk '{print $2}'	# print all mac addresses for network interfaces
ip addr show					# netplan: show network configuration
ip addr show dev ETH				# netplan: show specific network configuration for ETH
ip route show					# netplan: get gateway
ip link show dev ETH				# netplan: see ETH network interface info
 
cat /etc/resolv.conf				# get dns
 
netstat -tulpn | grep :###			# find out what process is using port ###
ss -tulpn | grep :###				# same as previous line (ss replaces netstat)
netstat -tulpn | grep LISTEN			# find all ports currently in use
 
iftop						# detailed CLI view of network traffic (must be installed)
 
hostname					# view current hostname
hostname NAME					# set hostname as NAME temporary (goes away on reboot)
hostnamectl set-hostname NAME			# set hostname as NAME permanently

Resources: 'ip' Command Cheat Sheet

Settings

# To manually change your network settings using Netplan (Ubuntu 18+)...
ip link						# see all network interfaces and status
nano /etc/netplan/*.yaml			# modify network configuration (* means file could be named anything)
netplan apply					# reload network configuration
 
# To manually change your network settings using the Network Manager GUI (CentOS 7+)...
system-config-network				# configure all network settings in GUI window (need CentOS 7 w/ GUI)
nmtui						# configure network settings in a command line GUI
nmtui edit IFACE				# configure network settings for IFACE in a command line GUI
systemctl restart network			# restart network interface (CentOS 7)
systemctl restart NetworkManager		# restart network interface (CentOS 8)
 
# To manually change your network settings using Network Manager (CentOS 7+)...
nmcli d						# see all network interfaces and status
nmcli c modify ETH ipv4.addresses IP/SUB	# set ETH interface to IP with SUB subnet (i.e: 10.0.0.30/24)
nmcli c modify ETH ipv4.gateway GATEIP		# set ETH interface to GATE gateway
nmcli c modify ETH ipv4.dns "DNSIP1 DNSIP2"	# set ETH interface to DNS address DNSIP1, DNSIP2 optional
nmcli c modify ETH ipv4.method manual		# set ETH interface to manual IP settings
nmcli c modify ETH ipv4.method auto		# set ETH interface to DHCP
nmcli c down ETH; nmcli c up ETH		# reload ETH interface and settings
 
# To manually change your network settings without Network Manager (CentOS 6)...
nano /etc/sysconfig/network-scripts/ifcfg-eth0	# Configure eth0 Interface
nano /etc/sysconfig/network			# Configure Default Gateway
/etc/init.d/network restart			# Restart Network Interface
service network restart				# Restart Network Interface
nano /etc/resolv.conf				# Configure DNS Server
nano /etc/hosts					# Configure Hosts

Resources: CentOS 7 Network Settings, Channel bonding modes, How to create a bond in Ubuntu, Configure Static IP using Netplan, Configure VLAN in CentOS 7

Proxy

CentOS 8: Global Proxy

Create the file /etc/profile.d/proxy.sh with the following content:

proxy.sh
MY_PROXY_URL="<_PROXY_SERVER_>:3128"
 
HTTP_PROXY=$MY_PROXY_URL
HTTPS_PROXY=$MY_PROXY_URL
FTP_PROXY=$MY_PROXY_URL
http_proxy=$MY_PROXY_URL
https_proxy=$MY_PROXY_URL
ftp_proxy=$MY_PROXY_URL
 
export HTTP_PROXY HTTPS_PROXY FTP_PROXY http_proxy https_proxy ftp_proxy

CentOS 8: DNF/YUM Proxy

DNF does not use the global proxy. Add the following line to the end of /etc/dnf/dnf.conf to enable a proxy for DNF only. 

proxy=<_PROXY_SERVER_>:3128

Docker Proxy

Docker does not use the global proxy. Create the file /etc/systemd/system/docker.service.d/http-proxy.conf with the following content:

http-proxy.conf
[Service]
Environment="HTTP_PROXY=<_PROXY_SERVER_>:3128"
Environment="HTTPS_PROXY=<_PROXY_SERVER_>:3128"

… then run the following commands: 

systemctl daemon-reload					# reload service configuration
systemctl restart docker				# restart docker service
systemctl show --property=Environment docker		# verify that environment variables are loaded

Resources: CentOS 8 Proxy Client, Docker Proxy

File Transfer

wget "http://remote.file"		# Download file from the internet to current directory
wget -O FILE "http://remote.file/"	# Download file from the internet, rename file to FILE
wget "http://remote.file/" -P DIR	# Download file from the internet to DIR directory 
scp FILE USR@SVR:			# Upload file FILE to server SVR as user USR
scp -r SRC USR@SVR:DEST			# Upload directory SRC to server SVR in directory DEST as user USR
rsync -avu SRC USR@SVR:DEST		# Same as previous, but only send newer files
 
source <(curl -s http://script.sh)	# Download script from internet, run script directly
bash <(curl -s http://script.sh)	# Same as previous, but works on macOS/FreeBSD
curl -L https://script.sh | bash	# Another method to do the same

Firewall

IPTables

iptables -S			# see current iptables configuration
iptables -L			# lists all rules for default tables only
iptables -F			# flush all rules

FirewallD (CentOS)

firewall-cmd --state						# check if firewall is running and active
firewall-cmd --list-all						# show all open ports in each active zone
firewall-cmd --get-active-zones					# show all active zones
firewall-cmd --get-services					# list all services
 
firewall-cmd --zone=ZNE --add-service=SVC --permanent		# open service SVC in zone ZNE permanently
firewall-cmd --zone=ZNE --add-port=XXX/tcp --permanent		# open tcp port XXX in zone ZNE permanently
firewall-cmd --zone=ZNE --remove-port=XXX/tcp --permanent	# close tcp port XXX in zone ZNE permanently
firewall-cmd --zone=drop --add-source=IP --permanent		# block IP from connecting (drops all packets)
firewall-cmd --zone=drop --add-source=IP/SUB --permanent	# block subnet SUB from connecting
 
firewall-cmd --zone=ZNE --list-sources --permanent		# list sources in zone ZNE
firewall-cmd --zone=ZNE --add-source=IP --permanent		# whitelist IP in zone ZNE
firewall-cmd --zone=ZNE --remove-source=IP --permanent		# remove IP from whitelist
 
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d IP/SUB  -j REJECT	# block outgoing connection to IP
firewall-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -d IP/SUB  -j REJECT	# remove IP block rule
firewall-cmd --direct --get-all-rules						# view all direct rules
 
firewall-cmd --reload						# reload firewall
 
/etc/firewalld							# location of firewalld configuration (backup)
/etc/firewalld/direct.xml					# location of firewalld direct rules

UncomplicatedFirewall (Ubuntu)

ufw enable				# enable firewall
ufw disable				# disable firewall
ufw status verbose			# get status, shows rules if firewall is enabled
ufw status numbered			# get status, show number for each firewall rule
 
ufw allow PRT				# open port PRT for all protocols
ufw allow PRT/tcp			# open port PRT for protocol TCP
ufw allow SVC				# open service SVC (http, https, ssh, ...)
ufw allow PRT:RNG			# open port range from PRT to RNG for all protocols
 
ufw delete NUM				# close port relating to rule NUM (see "ufw status numbered")
ufw delete allow PRT			# close port PRT by removing allow rule for PRT
 
ufw deny from IP			# block ip address IP (or range IP/SUB)
ufw allow from IP to any port PRT	# allow ip address IP to connect to port PRT
 
ufw reload				# reload firewall
 
ufw reset				# reset to factory settings

Resources: IBPING Manual, Network Configuration, Restart Network Service, Detect Physical State of Connector, Open Firewall Port in CentOS 7, Basic Operation of Firewalld, Introduction to FirewallD on CentOS, Ubuntu Firewall, How To Set Up a Firewall with UFW

SSL/TLS

OpenSSL

openssl genrsa -out KEY 2048					# generate private key KEY 
openssl req -new -key KEY -out CSR				# generate CSR (named CSR) 
openssl x509 -req -days 365 -in CSR -signkey KEY -out CRT	# generate self-signed cert CRT
openssl x509 -enddate -noout -in CRT				# get expiration date of certificate CRT
 
/etc/pki/tls/certs/						# location of certificates (CRT)
/etc/pki/tls/private/						# location of private key (KEY) and CSR
/etc/ssl/certs/							# location of certificates (ubuntu)
/etc/ssl/private/						# location of private key (ubuntu)

Resources: Setup SSL with CentOS

File Management

pwd			# print the current working directory
cd ..			# go up a directory
cd -			# go to previous directory
 
mkdir NAME		# create a directory
cp SRC DEST		# copy a file/directory
cp -R SRC DEST		# copy a directory recursively
cp -p SRC DEST		# copy a file/directory, preserving its permissions, owner, etc
mv SRC DEST		# move/rename a file/directory
rm SRC			# delete a file/directory/symlink
rmdir DIR		# delete a directory (will fail if DIR is not empty)
rm -rf SRC		# delete entire directory recursively with no prompts (*DANGEROUS*)
ln -s SRC LINK		# make the symbolic link LINK pointing to SRC

File/Directory Sizes

ls -lh /DIR/				# list DIR info in human readable form
ls -d PREFIX*				# list all directories with PREFIX 
df -lh					# check amount of filesystem in use in human readable form
df -aTh					# similar to above
du -sh /DIR/				# check total size of directory, summarizes to just 1 line
du -hsx /DIR/ | sort -rh | head -10	# get largest folders, sort by largest, show the top 10
for i in G M K; do du -hsx /DIR/ | grep [0-9]$i | sort -nr -k 1; done | head -n 11
					# same as above (for when the prev command doesn't quite work)

Finding Files/Directories

find				# find all files in current directory and subdirectories
find DIR -name "FILE"		# find all files matching FILE in DIR directory
find / -name "FILE" -ls		# find all files on ROOT matching FILE and show details
find . -type f -mtime +30	# find all files in current directory older than 30 days
 
locate FILE			# find all files matching FILE; faster than find as it's database driven
locate -r /FILE$		# find all files matching exact string FILE
 
whereis BIN			# find the path for the binary BIN (like program files)

Resources: Find a Directory On Linux Based System

Directory Color Guide

Filesystem

fdisk -l 			# list all connected partitions
fdisk -l | grep '^Disk'		# simpler view of previous command
df -h				# list partitions, mount points, and Avail/Used/Free space
df -aTh				# a more detailed version of the previous command
df -h -x overlay		# list partitions, but don't show overlay filesystems (i.e: docker, etc)
nano /etc/fstab			# Edit file table
 
umount DIR			# Unmount DIR
mount -a 			# Remount all mount points listed in file table
mount SRC MNT			# Mount SRC at MNT: e.g: "mount /dev/sdc1 /student"
mount -t FS -o loop SRC MNT	# Mount disk image: e.g: "mount -t vfat -o loop floppy.img /mnt/floppy/"
mount -t iso9660 -o loop SR MT	# Mount CD/DVD image SR at mount point MT
mount -o ro SRC MNT		# mount SRC at MNT as read-only
mount -t nfs SRC MNT		# mount NFS mount SRC at MNT: e.g: "mount -t nfs csc-san3:/mnt/SAN3/BACKUP2 /storage/san3"
 
cat /dev/sdb >/dev/sdc		# copy entire contents of drive SDB to drive SDC (like dd but fast & efficient)
 
fdisk /dev/sdXX			# partition disk sdXX, n=create partition, w=write partition, q=quit w/o change
mkfs.ext4 /dev/sdXX1		# format partition sdXX1 as EXT4 file system
 
mke2fs -n /dev/sdXX		# see all superblocks needed to repair filesystem on SDXX (eg: sda2, sdd1, etc)
e2fsck -b 000 /dev/sda2		# repair a file system using the superblock 000
 
vgdisplay			# view all volume groups
lvdisplay			# view all logical volumes (lvm)
 
cfdisk				# visual partition manager (useful for lvm in ubuntu 16)
 
lvresize -l +100%FREE /dev/VGLG	# resize logical volume to remaining physical free space (useful for ubuntu 18)
resize2fs /dev/VGLG		# resize underlying file system to new logical drive size (useful for ubuntu 18)
 
fallocate -l SIZ FIL		# create file FIL of blank size SIZ (e.g: 10G, 2G, 100M...), faster than dd

Resources: How to Format a Disk in Linux, Mount and Unmount Examples, How To Setup NFS, Extend Logical Volume in RHEL VM, Expand a Hard Disk with Ubuntu LVM

Archives (Zip/Tar)

tar -C DEST -zxvf SRC	# decompress SRC file to DEST directory, filename e.g: grid-db.tar.gz
tar -czvf DEST SRC	# compress SRC file/dir to DEST file
unzip FILE		# decompress FILE to current directory
unzip FILE -d DIR	# decompress FILE to directory DIR
zip FILE *		# compress everything in current directory to FILE
zip -r FILE *		# compress everything in current directory INCLUDING subdirectories to FILE
zip -ur FILE FILE2	# add FILE2 to the existing archive FILE
zip FILE -@ < LIST	# add each file listed in LIST (1 filename per line) to the archive FILE
jar -vxf FILE.war	# unzip FILE.war to current directory

RAID Management

mdadm --examine /dev/sdXX /dev/sdYY	# check for existing RAID blocks on drives/partitions
 
mdadm --create /dev/mdZZ --level=Y --raid-devices=N /dev/sdXX /dev/sdYY
					# creates a raid device mdZZ, with raid level Y, using N devices, etc
					#   mdZZ: md0, md1...
					#   Y: RAID Level (0, 1, 5, 6, 10)
					#   N: Number of drives in array
 
cat /proc/mdstat					# get instantaneous status raid build
mdadm --detail /dev/md0					# get status of raid array
mdadm --detail --scan --verbose >> /etc/mdadm.conf	# generate linux raid config

Resources: Creating RAID 5 in Linux, Configure RAID on Ubuntu 20 Installation

iSCSI Management

yum install iscsi-initiator-utils		# install iscsi initiator, if not installed
 
systemctl start iscsi				# start iscsi
systemctl stop iscsi				# stop iscsi
systemctl restart iscsi				# restart iscsi
systemctl status iscsi				# get status of iscsi
 
/etc/iscsi/iscsid.conf				# iscsi configuration (set CHAP user/pass)
 
iscsiadm -m discovery -t st -p IPADDR		# discover iscsi targets on target IPADDR
iscsiadm -m node --login			# login to discovered iscsi targets
iscsiadm -m session -o show			# show currently connected iscsi targets
cat /proc/partitions				# confirm available partitions
 
iscsiadm -m node -T TRGT -u -p IPADDR:3260	# log out of iscsi target TRGT located on IPADDR
iscsiadm -m node -T TRGT -p IPADDR -o delete	# delete discovered target TRGT located on IPADDR from memory
iscsiadm -m node				# show all discovered targets

Resources: Configure iSCSI on CentOS, Configure iSCSI Initiator

Miscellaneous

lsof			# list all open files
lsof FILE		# list all processes that opened FILE
lsof /MNTPT		# list all open files on MNTPT mountpoint
lsof | grep ETC		# list all open processes related to ETC
 
rsync			# see http://www.techonthenet.com/linux/commands/rsync.php
rsync -avzP SRC DEST	# copy SRC to DEST, archival mode, preserve permissions, owner, timestamps, etc.
			# use when you want to do a dd/cat but operating with files instead of blocks/bytes
 
/etc/skel/		# Anything that goes in here gets copied to a new users directory

Resources: LSOF Command Examples, How to Use RSYNC, RSYNC Backup Help, More RSYNC Backup Help

Text Editors & Text Manipulation

vi FILE			# open a file to read
vim FILE		# open a file to read in VIM (similar to VI, but advanced with colored text)
  			# ESC [then] :q! [then] ENTER		exit without saving changes
  			# ESC [then] :w [then] ENTER		save changes, leave vi running
  			# ESC [then] :noh [then] ENTER		clear search highlighting
			# ESC [then] :s/STR [then] ENTER	search for STR in document
			# ESC [then] :## [then] ENTER		skip to line ## in document
 
nano FILE		# open a file to read
 
tail TXT		# view the last 10 lines of file TXT
tail -f TXT		# view the last 10 lines of file TXT and keep showing any new lines (ctrl+c to exit)
tail -20 TXT		# view last 20 lines of file TXT
tail -20 -f TXT		# view last 20 lines of file TXT, keep showing any new lines (ctrl+c to exit)
 
cat TXT			# print entire file TXT to screen
cat -n TXT		# print entire file and show line numbers
cat TXT | grep STR	# print only the lines containing string STR in entire file TXT
grep STR FILE		# functionally the same as the previous command
cat TXT | more		# print file TXT to screen, make it scrollable
			# ENTER		scroll by line
			# SPACE		scroll by page
			# CTRL+C	exit
cat TXT | less		# print file TXT to screen, scroll forward and backward
			# ARROW-DOWN	scroll by line down
			# ARROW-UP	scroll by line up
			# SPACE		scroll down by page
			# q		exit
cat TXT | cut -c1-80	# print file to screen, only show from char 25-50 (neat way to disable word wrap)
 
sed "s/STR/RPL/" FILE	# substitute STR with RPL in FILE, do not modify file
sed -i "s/STR/RPL/" FIL	# substitute STR with RPL in FIL, save changes to file
sed -i "/STR/d" FILE	# delete lines containing STR from FILE, save changes to file
 
diff FILE1 FILE2	# compare two files, FILE1 (<) and FILE2 (>)
diff -c FILE1 FILE2	# same as above, but show more context around differences

Resources: Basic vi Commands

Services & Applications

Apache/HTTPD

General

yum install httpd mod_ssl			# install apache with ssl support (centos)
apt install apache2				# install apache (ubuntu)
 
a2enmod ssl					# (ubuntu) enable ssl mod (required for ssl)
a2enmod headers					# (ubuntu) enable header mod (required for security hardening)
 
systemctl start httpd.service			# start apache
systemctl stop httpd.service			# stop apache
systemctl restart httpd.service			# restart apache
systemctl status httpd.service			# get status of service
 
systemctl start apache2.service			# (ubuntu) start apache
systemctl stop apache2.service			# (ubuntu) stop apache
systemctl restart apache2.service		# (ubuntu) restart apache
systemctl status apache2.service		# (ubuntu) get status of service
 
/etc/httpd/conf/httpd.conf			# main configuration
/etc/httpd/conf.d/ssl.conf			# ssl configuration (optional, has location of cert/key)
/etc/httpd/conf.d/userdir.conf			# user folder configuration (optional)
/etc/httpd/conf.d/vhosts.conf			# virtual hosts configuration (optional)
/etc/httpd/conf.modules.d/90-alias.conf		# aliases configuration (optional)
 
/etc/apache2/apache2.conf			# (ubuntu) main configuration
/etc/apache2/sites-enabled/000-default.conf	# (ubuntu) default virtual host (also put ssl & force ssl here)
 
/var/log/httpd/*				# all log files, including php logs
 
apachectl configtest				# check apache configuration for errors
 
chcon -R --type=httpd_sys_rw_content_t DIR	# enable DIR to host web pages with SELinux enabled (useful for userdir)

Security Hardening

Modify configuration file /etc/httpd/conf/httpd.conf (CentOS) or /etc/apache2/apache2.conf (Ubuntu)… 

# Modify line ~144 to disable indexes and symlinks
Options -Indexes -FollowSymLinks

# --- Place At End Of File ---
# Web Server Security Hardening
ServerSignature Off
ServerTokens Prod
TraceEnable off
Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block"
Header set X-Permitted-Cross-Domain-Policies "none"
Header always append X-Frame-Options SAMEORIGIN
Header set Referrer-Policy "no-referrer"
Header set Content-Security-Policy "default-src 'unsafe-inline' *.<_COMPANY_TLD_>; script-src 'unsafe-inline' 'unsafe-eval' *.<_COMPANY_TLD_>; font-src 'self' data:; img-src 'self' data:;"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Custom Error Pages
ErrorDocument 404 /404.html
ErrorDocument 403 /403.html

# Force SSL
<VirtualHost *:80>
  ServerName __SERVER_HOSTNAME_HERE__
  RedirectMatch permanent ^/(.*)$ https://__SERVER_HOSTNAME_HERE__/$1
</VirtualHost>

# Force SSL (Alternative Method)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}$1 [R,L]

For CentOS, modify configuration file /etc/httpd/conf.d/ssl.conf… 

# Modify relevant parts to the following (line ~54)
SSLEngine on
SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder on
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
SSLCertificateFile /path/to/ssl/certificate
SSLCertificateKeyFile /path/to/ssl/key

For Ubuntu, modify configuration file /etc/apache2/sites-enabled/000-default.conf… 

# --- Place At End Of File ---
<VirtualHost *:443>
	ServerName __SERVER_HOSTNAME_HERE__
	DocumentRoot /var/www/html

	SSLEngine on
	SSLProtocol ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	SSLHonorCipherOrder on
	SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
	SSLCertificateFile /path/to/ssl/certificate
	SSLCertificateKeyFile /path/to/ssl/key
</VirtualHost>

Resources: Install a LAMP Stack using CentOS 7, Install a LAMP Stack using Ubuntu 20, Configure SSL in Apache on Ubuntu 20, Enable Per-User Directories, Content Security Policy, How to Implement Security HTTP Headers

PHP

Ubuntu 20: Install PHP

apt install php libapache2-mod-php php-mysql				# install php

CentOS 8: Install PHP

dnf install php php-cli php-gd php-curl php-mysqlnd php-ldap php-zip	# install php
 
dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm	# add remi repo (for php >v7.2)
dnf install dnf-utils							# install dnf utilities
dnf module reset php							# reset php repo
dnf module install php:remi-7.4						# enable remi repo for php 7 (v7.4)
dnf module install php:remi-8.1						# enable remi repo for php 8 (v8.1)
dnf install php php-cli php-gd php-curl php-mysqlnd php-ldap php-zip	# install php 7.4
 
/etc/httpd/conf/httpd.conf						# Modify line ~167 to add index.php

CentOS 7: Upgrade to v7.x

yum --enablerepo=extras install epel-release				# enable rhel epel
yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm	# add remi repo
yum-config-manager --enable remi-php74					# enable remi repo (php71, php72, php73, php74)
yum install php php-cli php-gd php-curl php-mysql php-ldap php-zip	# install php
 
/etc/httpd/conf/httpd.conf						# Modify line ~167 to add index.php

Security Hardening

Modify configuration file /etc/php.ini (CentOS) or /etc/php/7.4/apache2/php.ini (Ubuntu)… 

# Modify line ~375 and change expose_php from ON to OFF
expose_php = Off

Postfix (Sendmail)

systemctl start postfix.service			# start postfix
systemctl stop postfix.service			# stop postfix
systemctl restart postfix.service		# restart postfix
systemctl status postfix.service		# get status of postfix service
 
/etc/aliases					# email aliases file
/etc/postfix/main.cf				# postfix configuration file
/etc/postfix/master.cf				# postfix master configuration (enable amavisd/clamav here)
/etc/postfix/header_checks			# block unapproved mail attachments
/etc/postfix/client_checks			# block/allow senders by IP (smtpd_client_restrictions)
/etc/postfix/sender_checks			# block/allow senders by email (smtpd_sender_restrictions)
/etc/postfix/rbl_override			# whitelist servers from rbl checks (smtpd_relay_restrictions)
 
newaliases					# rehash aliases file (required for postfix)
postmap /etc/postfix/client_checks		# rehash client checks file (required)
postmap /etc/postfix/sender_checks		# rehash sender checks file (required)
postmap /etc/postfix/rbl_override		# rehash rbl override file (required)
 
/var/log/maillog				# postfix log file (contains postgrey log as well)
 
mail EMAIL < FILE				# send email to EMAIL, the body will be FILE
 
mailq						# view the mail queue
postfix flush					# flush themail queue
postsuper -d NUM				# delete message id NUM from the mail queue
postsuper -d ALL				# remove all mail from the queue
postsuper -d ALL deferred			# remove all deferred mail from the queue

Security Hardening

Modify configuration file /etc/postfix/main.cf… 

relayhost = [<_COMPANY_EMAIL_SERVER_>]		# route all mail through mail server (e.g: 'mailhost.example.org')
smtpd_client_restrictions = sleep 5		# rate limit outgoing mail

MySQL/MariaDB

yum install mariadb-server mariadb 		# install mysql
 
curl -LsS -O https://downloads.mariadb.com/MariaDB/mariadb_repo_setup	# download mariadb repo (for mysql >v10.3)
bash mariadb_repo_setup --mariadb-server-version=10.6			# set for v10.6
dnf install boost-program-options					# install utilities
dnf module reset mariadb						# reset mariadb repo
dnf install mariadb-server mariadb-client mariadb-backup		# install mysql v10.6
 
systemctl start mariadb.service			# start mariadb service
systemctl stop mariadb.service			# stop mariadb service
systemctl restart mariadb.service		# restart mariadb service
systemctl status mariadb.service		# get status of mariadb service
 
/usr/bin/mysql_secure_installation		# first run security hardening
/usr/bin/mariadb-secure-installation		# same as above, for v10.6
 
mysql --version					# test if mysql is installed and see what version is running
mysql -u root -pPASS				# log into mysql as administrator/root
mysqlcheck -c DATABASE -u root -pPASS		# check DATABASE for errors, PASS is for administrator/root
mysqldump DATABASE > FILE			# backup DATABASE to file FILE
mysql DATABASE < FILE				# restore DATABASE from file FILE
mysqladmin -u root -pPASS password NEWPASS	# change root password from PASS to NEWPASS

SQL-Specific Commands

source SRC.sql							-- run a set of sql commands stored in a file
 
SHOW DATABASES;							-- show all databases
CREATE DATABASE DB;						-- create a database
DROP DATABASE DB;						-- delete a database
USE DB;								-- select a database to view/edit
SHOW TABLES;							-- show all tables in a database
 
SET PASSWORD FOR 'user'@'localhost' = PASSWORD('mypass');	-- set USER password as MYPASS
 
GRANT ALL ON DB.* to 'user'@'localhost' identified by 'pass';	-- grant USER access to DB with password PASS
 
SELECT host, user, password FROM mysql.user;			-- list all users

Resources: Migrate MySQL User Privileges

Tomcat

systemctl start tomcat.service			# start tomcat service
systemctl stop tomcat.service			# stop tomcat service
systemctl restart tomcat.service		# restart tomcat service
systemctl status tomcat.service			# get status of tomcat service
 
/opt/tomcat/conf/tomcat-users.xml		# users config file (web mgmt console user/pass goes here)
/opt/tomcat/conf/server.xml			# server config file (per user folder listener goes here)
/opt/tomcat/logs/				# log files

SSH/Secure Shell

General

systemctl start sshd.service			# start ssh
systemctl stop sshd.service			# stop ssh
systemctl restart sshd.service			# restart ssh
systemctl status sshd.service			# get status of ssh service
 
/etc/ssh/sshd_config				# main configuration
/etc/hosts.deny					# block specific IP/IP ranges from SSH (tcp wrappers)
/etc/hosts.allow				# allow specific IP/IP ranges for SSH (tcp wrappers)
 
/var/log/secure					# log file location (CentOS/RHEL)
/var/log/auth.log				# log file location (Ubuntu/Debian)
 
dnf install rsyslog				# Required to enable log location on RHEL 8+

Security Hardening

Modify configuration file /etc/ssh/sshd_config… 

# Disable weak and deprecated ciphers
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,gss-gex-sha1-,gss-group14-sha1-
MACs umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512

For company-only access, run the following commands… 

# FirewallD (CentOS/RHEL)
firewall-cmd --permanent --zone=internal --add-source=<_COMPANY_IP_RANGE_>
firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/8
firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --reload; firewall-cmd --list-all
 
# UncomplicatedFirewall (Ubuntu)
ufw allow from <_COMPANY_IP_RANGE_> to any port 22
ufw allow from 10.0.0.0/8 to any port 22
ufw reload; ufw status

For non-company IP access, remove firewall commands and instead install Fail2Ban. 

# Remove Restrictions (FirewallD)
firewall-cmd --permanent --zone=internal --remove-source=<_COMPANY_IP_RANGE_>
firewall-cmd --permanent --zone=internal --remove-source=10.0.0.0/8
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --reload; firewall-cmd --list-all
 
# Remove Restrictions (UFW)
ufw delete allow from <_COMPANY_IP_RANGE_> to any port 22
ufw delete allow from 10.0.0.0/8 to any port 22
ufw reload; ufw status

Log Analysis

Replace LOG with the appropriate log file for the Linux architecture 

# Total number of log entries for SSHD
cat LOG | grep sshd | wc -l
 
# Number of successful logins
cat LOG | grep sshd | grep 'session opened' | wc -l
 
# List IPs of successful logins
cat LOG | grep -oE '.*Accepted password.*' | awk '{ print $11 }' | sort | uniq
 
# Total number of port scan attempts (bad)
cat LOG | grep -oE 'Received disconnect.*' | wc -l
 
# Total number of IPs that did port scans (bad)
cat LOG | grep -oE 'Received disconnect.*' | awk '{ print $4 }' | sort | uniq | wc -l
 
# List IPs of port scanners, with number of attacks per IP
cat LOG | grep -oE 'Received disconnect.*' | awk '{ print $4 }' | sort | uniq -c | sort -n
 
# Total number of bad login attempts
cat LOG | grep 'Invalid user' | wc -l
 
# List usernames of bad login attempts, with number of attempts per username
cat LOG | grep -oE 'Invalid user.*' | awk '{ print $3 }' | sort | uniq -c | sort -n

Resources: Parsing SSH Logs, Limit SSH by IP Address, Limit SSH without TCP Wrappers

Fail2Ban

yum install fail2ban				# install fail2ban
 
systemctl start fail2ban			# start fail2ban service
systemctl stop fail2ban				# stop fail2ban service
systemctl restart fail2ban			# restart fail2ban service
systemctl status fail2ban			# get status of fail2ban service
 
fail2ban-client status				# list active jails
fail2ban-client status sshd			# view banned ips in sshd jail
fail2ban-client set sshd banip IPADDR		# manually ban ip address IPADDR
fail2ban-client set sshd unbanip IPADDR		# manually unban ip address IPADDR
fail2ban-client unban --all			# unban all ips in all jails
fail2ban-client -h				# show list of commands
 
/etc/fail2ban/jail.conf				# default config
/etc/fail2ban/jail.local			# custom config (overrides jail.conf, set ignored ips)
/etc/fail2ban/jail.d/sshd.local			# sshd config (required to protect ssh)
/etc/fail2ban/filter.d/f2b-loop.conf		# nested jail processor
 
/var/log/fail2ban.log				# log of fail2ban activity (bans/unbans)

Resources: Install Fail2Ban on CentOS, Increased Ban Times for Repeat Offenders

CRON

crontab -e			# edit current user crontab
 
/etc/crontab			# location of system crontab
/var/spool/cron/crontabs/	# location of user crontabs
 
# Special Strings
@reboot /path/to/script		# Run once, at startup.
@yearly /path/to/script		# Run once a year........ "0 0 1 1 *"
@annually /path/to/script	# (same as @yearly)
@monthly /path/to/script	# Run once a month....... "0 0 1 * *"
@weekly /path/to/script		# Run once a week........ "0 0 * * 0"
@daily /path/to/script		# Run once a day......... "0 0 * * *"
@midnight /path/to/script	# (same as @daily)
@hourly /path/to/script		# Run once an hour....... "0 * * * *"

Resources Using crontab on Linux

CylancePROTECT

General

systemctl start cylancesvc		# start cylance service
systemctl stop cylancesvc		# stop cylance service
systemctl restart cylancesvc		# restart cylance service
systemctl status cylancesvc		# get status of cylance service
 
/opt/cylance/config_defaults.txt	# installation defaults (required)

Installation

# First, create the installation defaults file: /opt/cylance/config_defaults.txt
InstallToken=<_REDACTED_>
SelfProtectionLevel=2
LogLevel=2
VenueZone=<_REDACTED_>
UiMode=2
 
# Install Dependencies on Ubuntu
apt update
apt install libxml2-utils make gcc bzip2 linux-headers-generic
 
# Install Application on Ubuntu
dpkg -i cylance-protect.1604.x86_64.deb 
 
# Install Dependencies + Application on CentOS 7
yum install zlib CylancePROTECT.el7.rpm
 
# Register Installation w/ Cylance Console
/opt/cylance/desktop/cylance -r <_REDACTED_>

Active Directory

Join via 'Realm'

# Install Required Dependencies (RHEL/CentOS)
yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python
 
# Install Required Dependencies (Debian/Ubuntu)
apt -y install realmd oddjob oddjob-mkhomedir adcli samba-common-bin libnss-sss libpam-sss sssd sssd-tools packagekit
 
# Join to Domain
realm join --user=<_ADMIN_USER_>@<_USER_AD_DOMAIN_> <_AD_DOMAIN_SERVER_>
realm list					# confirm proper join
 
# Fix /etc/sssd/sssd.conf by uploading the correct copy
/etc/sssd/sssd.conf				# upload correct copy
systemctl restart sssd				# restart sssd service
 
# Test access (should show AD groups)
id <_AD_USER_>
 
# Ubuntu Systems Only
pam-auth-update					# make sure 'create home directory on login' is checked
dpkg-reconfigure gdm3				# fix login loop issue for GUI

Resources: Join CentOS 7 to AD, Join Ubuntu 20 to AD, Ubuntu Login Loop Fix

Leave via 'Realm'

# Leave the Domain
realm leave <_AD_DOMAIN_> -U '<_USER_AD_DOMAIN_PREFIX_>\<_ADMIN_USER_>'

Resources: Removing a System from a Domain

Restrict Access by AD Group

Modify /etc/sssd/sssd.conf with the following… 

[domain/<_AD_DOMAIN_>]
   access_provider = simple			# required
   simple_allow_groups = group1, group2		# group(s) to allow
   simple_deny_groups = group3			# group(s) to deny

[domain/<_USER_AD_DOMAIN_>]
   access_provider = simple			# required
   simple_allow_users = user1, user2		# user(s) to allow [DOES NOT WORK, 1/25/23]
   simple_deny_users = user3			# user(s) to deny [DOES NOT WORK, 1/25/23]

Note: Because user specific allow/deny isn't working, it's best to use AD groups to allow/deny in the interim.

Qualys Cloud Agent

General

systemctl start qualys-cloud-agent	# start qualys service
systemctl stop qualys-cloud-agent	# stop qualys service
systemctl restart qualys-cloud-agent	# restart qualys service
systemctl status qualys-cloud-agent	# get status of qualys service

Installation

# Install Application on Ubuntu
apt update
sudo dpkg --install QualysCloudAgent.deb
sudo /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId=<_REDACTED_> CustomerId=<_REDACTED_>
 
# Install Application on CentOS 7
sudo rpm -ivh QualysCloudAgent.rpm
sudo /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId=<_REDACTED_> CustomerId=<_REDACTED_>

ULimit

:!: This does not seem to work very well on RHEL/CentOS 7 systems. Please use cgroups instead. 

/etc/security/limits.conf				# adjust soft/hard limits for system resources

Resources: limits.conf Manual, How to set ulimit values

XRDP

# Install XRDP on CentOS 8 (Rocky/AlmaLinux/RHEL)
dnf groupinstall "Server with GUI"			# install system GUI
dnf install epel-release				# install pre-requisites
dnf install xrdp					# install xrdp
systemctl enable xrdp					# enable xrdp service
systemctl start xrdp					# start xrdp service
firewall-cmd --add-port=3389/tcp --permanent		# open firewall port for RDP (3389)
firewall-cmd –reload					# reload firewall
 
# Install XRDP on Ubuntu 20/22
apt update						# update package manager
apt install ubuntu-desktop				# install system GUI
apt install xrdp					# install xrdp
systemctl status xrdp					# check if xrdp service is running
adduser xrdp ssl-cert					# add xrdp user to ssl-cert group
ufw allow 3389; ufw reload; ufw status			# open firewall port for RDP (3389), reload

Resources: CentOS 8 Remote GUI with RDP, Install XRDP on Ubuntu

Disk Quotas

/dev/sdbX   /DIR   ext4   defaults,usrquota,grpquota 0 0	# edit /etc/fstab, add 'usrquota' & 'grpquota' to mount, reboot
 
quotacheck -um /DIR					# create user quota config
quotacheck -gm /DIR					# create group quota config
quotaon -uv /DIR					# enable user quota
quotaon -gv /DIR					# enable group quota
quotaon -ap						# show on/off status
edquota -u USR						# edit quota for user USR
edquota -g GRP						# edit quota for group GRP
repquota -asu						# show user quota report/status
repquota -asg						# show group quota report/status

Resources: Set Disk Quota, EXT4, Set Disk Quota, XFS

Docker

CentOS 7/8: Install Docker

yum install -y yum-utils								# install utils
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo	# install repo
yum install docker-ce docker-ce-cli containerd.io docker-compose-plugin			# install docker

Resources: Install Docker on CentOS

General

systemctl start docker				# start docker service
systemctl stop docker				# stop docker service
systemctl restart docker			# restart docker service
systemctl status docker				# get status of docker service
 
docker run hello-world				# test if docker is working
 
docker compose up				# run all dockers listed in ./docker-compose.yml
docker compose up -d				# same as previous but runs in the background
docker compose down				# stop all dockers listed in ./docker-compose.yml
docker ps -a					# see status of all containers, get container id
docker stats					# show performance statistics of all containers
docker stop MYAPP 				# kill container MYAPP gracefully (can use id or name)
 
docker compose pull				# pull updated containers (will recreate containers on next 'compose up')

CGroups

# Install cgroups
yum install libcgroup libcgroup-tools
 
# Enable Services
chkconfig cgconfig on
chkconfig cgred on
 
# Control Services
systemctl status cgconfig				# service that does the actual controlling
systemctl status cgred					# service that decides how to apply controls
systemd-cgtop						# see which cgroups are running and their resources
 
# Configure
/etc/cgconfig.conf					# Default configuration - do not edit
/etc/cgconfig.d/cpu_cap.conf				# Custom configuration (can be named anything)
/etc/cgrules.conf					# Apply specific cgconfig rules to specific users/processes

Resources: Hand rolling your own cgroup

GIT

[working dir] -> git add -> [staging area] -> git commit -> [repository]
   |                           |                               |         
   |                           |                            git log      
   |                           |            (shows files tracked in repo)
   |                           |                                         
   |                       git status                
   |                     (shows what's in staging)
  git diff
 (shows changes between working & staging)  
get --version		# show current installed version of git
 
git init		# create repo in current directory
git add FILE		# add FILE to repo
git commit -m "MSG"	# commit repo, add MSG as description
 
git diff		# show differences since last commit
git log			# see change log
git status		# see status of files (between add and commit )
 
git branch		# see branches
git branch BRCH		# create branch named BRCH 
git checkout BRCH	# switch to branch BRCH
 
git config --global user.name <name>	# set author name to NAME
git config --global user.email <email>	# set author email to EMAIL