Linux Study Notes Flashcards
(95 cards)
1
Q
What is the first Unix Shell?
A
Bourne Shell
Also referred to as “The Shell”
2
Q
Who created the first Unix Shell?
A
Stephen R. Bourne
3
Q
What are the three types of Unix Shells?
A
Login Shell, Interactive Shell, Non-Interactive Shell
4
Q
What is a Login shell?
A
The shell that is run when you log in to a system, either via the terminal or via SSH.
5
Q
What is an Interactive shell?
A
A shell that actively reads commands from user input
6
Q
What is a Non-Interactive shell?
A
A shell that cannot interact with the user. it’s most often run from a script or similar.
This means that .bashrc and .profile are not executed.
Init and startup scripts are necessarily non-interactive, since they must run without human intervention.
7
Q
What is a KERNEL?
A
This is the software that acts as the brain in Linux. It controls the hardware, which is then able to interact with applications.
8
Q
What is a process?
A
A process is any active (running) instance of a program.
9
Q
What is a boot loader?
A
A program that boots the operation system.
examples of boot loader are GRUB and ISOLINUX.
10
Q
What is CLI?
A
Command Line Interface
an interface for typing commmands on top of an OS.
11
Q
What is the DAEMON?
A
A Linux/UNIX program that runs in the background.
12
Q
What is a Systemcall?
A
The fundamental interface between an application and the Linux kernel (OS).
13
Q
What is a File System?
A
A method for storing and organizing files in Linux.
14
Q
What are the READ and WRITE interface numbers for a Systemcall?
A
Read = 0 Write = 1
15
Q
What Systemcall gets time of day?
A
Syscall 96
gettimeofday
Gets the system time in seconds since 12:00 AM Jan. 1, 1970
16
Q
What is the Systemcall 99?
A
sysinfo
gets information about memory usage and CPU load average
17
Q
What processes are at the “least-privileged” level?
A
User processes (when a program is executed in User Mode, it cannot directly access the kernel data structures or the kernel programs)
18
Q
Describe the Kernel Mode.
A
The Kernel mode is the privileged mode where the process has unrestricted access to the system resources like hardware, memory, etc.
The Kernel itself is not a process but a PROCESS MANAGER.
19
Q
(True or False)
System Calls are the only way through which a process can go into kernel mode from user mode.
A
TRUE
20
Q
What are the 2 types of device drivers and what do they do?
A
Kernel-mode Device Drivers and User-mode Device Drivers.
Device drivers let the OS know how to access and use information from that device. They act as a translator between a device and the app or OS that uses it.
21
Q
What does the Kernel-Mode Device Driver include?
A
This includes generic hardware that loads the BIOS, motherboard and processor.
It also includes the minimum system requirement device drivers for each OS.
22
Q
What is an aka for User-Mode Device Driver and give example.
A
aka: user space driver
Example: USB driver which handles the different devices connected through a USB port. If problems, the task can be killed.
23
Q
What are the common device drivers?
A
Character, Block, Network and USB Drivers
24
Q
What command lists all PCI buses in the system along with the devices connected to them?
A
lspci
- n (shows device code as numbers)
- k (kernel drivers @device & modules)
- v (description all devices)
25
System call and signals can be traced by utilizing what command?
strace ls
26
Also know as Modules, what is built into the base kernel and were created to allow users to add code to the Linux Kernel while it is running?
LKM or Loadable Kernel Modules
27
What interprets the contents of a file system and can be added to a LKM?
File System Drivers
28
(True or False)
A majority of the system calls are built into the Kernel, but a user can invent a system call of their own and install it as an LKM.
TRUE
29
What driver interprets a network protocol?
Network drivers
30
What loads and runs an executable?
Executable Interpreters
31
What command will show the status of currently loaded LKMs?
lsmod
32
In Linux, and executable stored on a disk is called what?
a Program
33
A program loaded into memory and running is called what?
A PROCESS
34
what does PID and PPID stand for?
PID - Process ID
PPID - Parent Process ID
35
When a process is started, it is given a unique number called what?
Process ID
| PID & PPID
36
What assigns the unique PID?
the Kernel
37
Files in what directory are executed first, then the files in the home directory follow?
the /etc directory
38
What command lets us see what login shell the user is currently operating in?
echo $0
use echo $SHELL to show what type of shell you're in
39
Where do we go to set up an alias, variables, scrips to automatically run upon startup of every terminal?
.bashrc
within a user's account & typically in the root directory /
40
What are local variables?
restricted in scope and ONLY accessed in the shell in which they were created. They are not transferred to a new shell when the variable is created because they are used by the shell itself, not applications. Example: history.
41
What is a user restricted to in a restricted shell?
Restricted users can only use current directory
42
What are environmental variables?
Variable set across user accounts.
43
What are the 4 examples of Environmental Variables?
Path, Home, Shell, User
Path - list of directories searched by shell to locate a command.
Home - User's home dir upon login.
Shell - User's login shell & the one invoked by programs having shell escapes.
User - Login name of user - LOGNAME
to View, printenv
44
What does sftp stand for and do?
Secure File Transfer Protocol & Securely transfer files to and from a remote network.
45
Why is SFTP secure?
because it requires a login and password just like SSH and provides encryption.
46
If using ftp, what can you do to make it secure?
Tunneling using SSH.
You can utilize a secure shell like ssh in conjunction with the cp (copy) and ftp commands to securely copy and transfer files between hosts.
47
What are the three basic types of Linux user accounts?
Administrative, Regular and Service
48
Which user account has the most privileges?
Administrative and the root account is also know as "Super User"
49
Which directory are the passwords stored?
/etc/shadow - contains encrypted passwords and bookkeeping info
/etc/passwd - contains a list of local users and their data
50
What identifies the user on a system?
The username and user ID (UID)
51
When a user account is created, it is given a same and assigned a UID which must be a positive number and above what number?
above 500
| each user has its own password
52
System accounts usually have what numbers?
numbers below 100
53
What command is used to add a user account?
sudo useradd
54
If using useradd, what does -c do?
| what does -e do?
- c allows you to add a comment
| - e sets ab expiration date
55
What is the command to create a group?
sudo groupadd
56
What command do you use to show a user's UID?
id 'username'
57
From the command line, what does the command 'netstat' do?
Displays the status of the network
58
What does the command 'ping' do?
checks network connectivity and ICMP requests
59
What are other network config commands?
ifconfig - displays the configuration for a network interface
traceroute - shows the path taken to reach a host
route - displays the routing table and/or lets you configure it
arp - shows the address resolution table and/or lets you configure it
60
What are some common interface names seen?
lo - Loopback interface
en - Ethernet
wl - Wireless LAN (WLAN)
ww - Wireless WAN (WWAN)
61
What does Samba do?
A suite of software developed to provide file and print sharing between different OS'.
Using the SMB (Server Message Block) protocol or CIFS (Common Internet File System), Samba provides secure, stable, and fast file and print services for all clients.
62
Samba's functionality comes from two daemons. What are they?
smbd - Server Message Block Daemon
| nmbd - NetBIOS Message Block Daemon
63
What are the two Samba security modes?
Share-Level
| User-Level: default setting
64
What are the four ways to implement Samba user-level?
User Security Mode - Provides username and password
Domain Security Mode - has machine acct (domain security trust account) and causes all authentication requests to be passed through to the domain controllers.
Active Directory Security Mode - Samba server can join an Active Directory Security using Kerberos.
Server Security Mode - previously used when Samba was not capable of acting as a domain member server.
65
What is LDAP?
Lightweight Directory Access Protocol:
Central place for AUTHENTICATION. it stores usernames and passwords.
a mechanism for interacting with directory servers. It's often used for authentication and storing information about users, groups and applications.
66
What is the most commonly used Web server on Linux systems?
Apache web server.
The Apache2 web server is available in Ubuntu Linux.
install by using command: sudo apt install apache2
67
Why do we have iptables?
Command-line firewall utility that uses policy chains to ALLOW or BLOCK traffic.
When a connection tries to establish itself on your system, iptables look for a rule in it's list to match it to. If it doesn't find one, it resorts to the default action.
To install/update: sudo apt-get install iptables
68
In iptables, what are 'rule-sets'?
Rules are defined for the packets.
If the input matches a rule, the target action defined in the rule is performed.
If no match is found at the end of a chain, a special kind of target called the default policy is applied and can only be ACCEPT or DROP.
Structure is: iptables > Tables > Chains > Rules
69
What are the three IP Tables?
Filter - used to control the flow of packet in and out of a system
(INPUT, OUTPUT & FORWARD chains)
NAT - used to redirect connections to other interface on the network (PREROUTING, POSTROUTING, OUTPUT chains)
Mangle - specialized for packet alteration. Commonly used to alter QOS and/or VLAN bits in the TCP header.
(ACCEPT, DROP, QUEUE, RETURN)
70
For the Mangle table, what are the possible special values that you can specify as the target action of the rule?
ACCEPT, DROP, QUEUE, RETURN
ACCEPT - Firewall will accept the packet
DROP - Firewall will drop the packet
QUEUE - Firewall will pass the packet to the userspace
RETURN - Firewall will stop executing the next set of rules in the current chain for this packet. Control returned to calling chain.
71
What command is used to show all existing iptables?
sudo iptables --list
72
What is FIM?
File Integrity Monitoring
Refers to an IT security process and tech that test and checks OS, db, and app software files to determine whether or not they have been tampered with or corrupted.
Reactive (forensic) auditing as well as proactive, rule-based active monitoring.
Establishing a BASELINE state and monitoring for file changes helps to protect sensitive data and maintain compliance.
73
When validating file integrity, what changes from the baseline?
Hashes do.
Hashes are unique to each file (like fingerprints). Without correct hash, you cannot make changes to these files. If authorized change, then NEW HASH is created for that file.
74
What are common hashes (MD5 hashing tools)?
MD5SUM, CRC-32, HAVAL, SHA-1, TIGER
The more secure hashes are typically the slowest.
75
What is NETWORK SECURITY?
It is a set of rules and configurations designed to protect the integrity, confidentiality and accessibility of computer networks and data using both software and hardware technologies.
76
What are some of the most common forms of network security?
Switch or Router with policies (ACL - Access Control List). works similar to software firewalls.
Dedicated Hardware Firewall
SIEM - Security Information & Event Management
Network Services: DNS Servers, Time Servers, VPN Concentrators, VPN Tunnels
77
What is Banner Grabbing often termed as?
Service Fingerprinting
Banners are the welcome screens that divulge software version numbers and other system information on network hosts. This can show the operating system, the version number, and the specific service packs to give the bad guys a leg up on attacking the network.
78
What are the two main types of Banner Grabbing?
Active & Passive Banner Grabbing
79
What is a way to grab the banner?
cURL command
Example: curl -s -I 192.168.x.x
wget command
80
What command will inform you which network ports are currently open and which services are making use of them?
netstat
81
What functions as the ancestor of all processes?
INIT
This is the first program ran when turning on computer. One responsibility of init is running the programs that let users log into the system.
For terminal, getty (get terminal) and login are used.
82
What is the file called where your login name is looked up?
/etc/passwd
which is a sequence of lines each describing a user account.
83
What is a syslog?
Syslog logs system events.
The syslog protocol is a way to transport messages from network devices to a syslog server.
Syslog provides a way for network devices to send messages and log events.
84
What protocol and port does syslog use to communicate?
UDP (User Datagram Protocol)
| Port 514
85
Syslog has three layers. What are they?
Content, Application, Transport
86
What elements does a syslog message contain?
Header, Structured Data, Message
Header - Includes host name, priority, application, process ID, and message ID
Structure Data - Contains data blocks followed by the message
Message - encoded using 8-bit Unicode Transformation Format (UTF).
87
Syslog servers have several components. What are they?
A Syslog Listener - UDP port 514
A Database
Management and Filtering Software
88
What command is used to view all our logs?
ls var/log
89
Key files on the Linux System.
What does /dev do?
Contains device files for all the hardware devices on the machine
90
Key files on the Linux System.
What does /srv do?
This directory contains server specific and service related files
91
what is a DPKG?
Debian Package - this is a base package management system for the Debian Linux family, used to install, remove, store and provide information about .deb packages.
92
What is APT?
Advanced Packaging Tool
Command line package management system that is a front end for dpkg package management system.
ex: sudo apt-get update
93
What is RPM and what tools go with it?
REDHAT Package Manager
YUM (Yellowdog Updater, Modified) is an open source and popular command line package manager that works as an interface for users to RPM.
DNF (Dandified Yum) a package manager for RPM-based distributions, introduced in Fedora 18 and is next generation of YUM
94
What is a popular and powerful, yet simple package manager for Arch Linux?
PACMAN Package Manager
Other package mgrs:
ZYPPER for OpenSUSE Linux, uses libzypp library
PORTAGE for Gentoo - simple and trouble free PM. backwards compatibility, automation +
95
What serves as a way to update Linux systems and keep them secure?
Patching
Security-related patches should be deployed IMMEDIATELY
