Troubleshooting

Question 1

Basic connectivity

Answer 1

> ping hostname or IP

> traceroute (must use with root privileges)

• • if host takes too long to respond ther could be an issue
• • if you see asterisk in output, a router is blocking connection

Question 2

View ports and programs

Answer 2

View running processes
>netstat
- n : shows ports
- a : active internet connections TCP and UDP
- i
- r
- p : shows PID
- l
- t: shows tcp
- u
>netstat -nutlp : shows active internet connections

View Ports
>nmap [IP address or name of target host]

Question 3

View live packets

Answer 3

> tcpdump : stop output with CTRL+C

• n
• A
• v
• vvv

Question 4

Kill a process

Answer 4

A process is simply an application or a script which can be running in the foreground or the background.

1. ps aux (show all running processes or “|grep chrome”)
   a = show processes for all users
   u = display the process’s user/owner
   x = also show processes not attached to a terminal
2. kill [process id]
   killall [process name]

Question 5

Start/stop/restart a service

Answer 5

A service is just another name for a daemon, which is a client / server application that runs in the background. A service is continuously listening for incoming requests and sends a response based on the request given
Services can also be found in the /etc/init.d/ directory and can be controlled in the same manner.

1. Service –status-all (show running services)
   OR Netstat –tulpn (shows all information about this ser)
2. Either “service”
   >sudo service httpd start
   ​>sudo service httpd stop
   ​>sudo service httpd restartOr “systemctl”
   >sudo systemctl stop httpd
   >sudo systemctl start httpd
   >sudo systemctl restart httpd

Question 6

System Logging

Answer 6

● Syslog servers
○ syslogd
○ rsyslog
○ syslog-ng
● Use logger to generate your own log
messages
● Use logrotate to automatically prune
messages.

Question 7

Permissions Troubleshooting

Answer 7

● Permissions on a directory can effect the files
in the directory.

● If the file permissions look correct, start
checking directory permissions.

● Work your way up to the root.

Question 8

Linux Networking

Answer 8

● DNS and name resolution
○ host
○ dig
● /etc/hosts
● /etc/nsswitch.conf

Question 9

What is my IP

Answer 9

> ip address

>ifconfig

Question 10

Determine hostname

Answer 10

○ hostname
○ hostname -f
○ uname -n

Question 11

Bring interface is up/down

Answer 11

ifup / ifdown

Question 12

Usefull commands for jobs and processes

Answer 12

● ps
● Ctrl-c
● Ctrl-Z
● bg
● fg
● jobs
● kill

Question 13

Default Log Directory

Answer 13

/var/log

Question 14

Third Party potential log directories

Answer 14

/etc *** – host specific system config

/opt *** -- config file for third party application software
                >bin
                >etc
                >lib
                >log  

/usr ** – sharable and read only files
>bin
>etc
>lib
>log
/var ** – var. data files generated by system or vendor

Question 15

Securing Network Services

Answer 15

• use a dedicated user for each service
• ports below 1024 are privileged service port
• stop and uninstall any service not used
• avoid services using unencrypted communication
• make service only listen to the interface they need. By default the service listens on all interfaces

Question 16

Viewing Firewall Rules

Answer 16

> iptables - L : Display the filter table

              - t nat -L: Display the nat table
              - vL : Dipslay using verbose output

Question 17

Configuring Firewall Rules

Answer 17

> iptables -P [CHAIN] [TARGET]
e.g. iptables -P INPUT DROP

Append Firewall Rule

Insert Firewall Rule

Delete Firewall Rule