Basics

The default display manager in RHEL 9 is called GDM(GNOME Display Manager) Linux Directory Structure: Linux files are organized logically in a hierarchy for ease of administration and recognition. This organization is maintained in hundreds of directories located in larger containers called file systems. Red Hat Enterprise Linux follows the Filesystem Hierarchy Standard (FHS) for file organization, which describes names, locations, and permissions for many file types and directories. The Linux directory structure is analogous to an inverted tree, where the top of the tree is the root of the directory, tree branches are subdirectories, and leaves are files. Path example: /etc/rc.d/init.d/README The etc directory is located under / -> here / is the parent and etc is the child. rc.d(child) is located under etc(parent) . init.d(child) is located under rc.d(parent) . README(leaf) is located under init.d(parent) . ==SUB-DIRECTORY:== A directory that has a parent directory. Note The root directory has no parent, and the lowest level subdirectory has no child. ...

One of the most rudimentary command in linux is ls. Some options of ls: Options Description -a Shows hidden files and directories. A file or directory name that begins with the period character. -l Displays long listing with detailed file information like file type, permissions, link count, owner etc. -ld Displays long listing of the specified directory but hides its contents. -lh Displays long listing with file sizes shown in human-friendly format. -lt Lists all files sorted by date and time with the newest file first. -ltr Lists all files sorted by date and time with the oldest file first (reverse). -R Lists contents of the specified directory and all its subdirectories (recursive listing). ls -l: Long listing of the files. ls -al: List all the hidden files in the current working directory. Debriefing the columns: Columns 1: The first character (hyphen or d) divulges the file type, and the next nine characters (rw-rw-r–) indicate permissions. Column 2: Displays the number of link. Column 3: Shows the owner name. Column 4: Exhibits the owning group name. Column 5: Identifies the file size in bytes. For directories, this number reflects the number of blocks being used by the directory to hold information about its contents. Column 6,7,8: Displays the month, day, and time of creation or last modification. Column 9: Indicates the name of the file or directory. ls -ll: Alternative of ls -l , does the same thing. ls -ld {directory_name}: Shows long listing of the specified directory. For example: ls -ld /usr ls -alh: To show all the files in the current directory with their sizes in human readable format. ls -lt: Shows the output in a sorted order by date and time with the newest file first. ls -R directory_name/by default the cwd is selected: Shows content of any specified directory recursively, if directory is not specified it will take the current working directory as a default argument. ...

pwd(Present working Directory): It shows the a user’s current working directory. pwd always returns the absolute path. Navigating directories: Absolute path: It is the full path starting from the top level path which is / to my current working directory. The absolute path will always start with / at the beginning. Relative path: It is not a full path but rather a path which depicts the location relative to our own current working directory. For example: we are in /home/user1 directory. To move upwards either we can write using the relative path like this → cd Desktop/ , or we can write using absolute path like this → cd /home/user1/Desktop/ ...

Volatile: Collecting hostname, date and time: hostname hostnamectl date cat /etc/timezone timedatectl epoch time: date +%s system uptime: uptime Network information: ip a # short form of ip addr show ifconfig # promisc mode detection: ifconfig eth0 ip link show eth0 # other network info commands: netstat -i netstat -rn # routing tables ip r # routing tables open port info: nmap -sT localhost nmap -sU localhost # UDP port sudo lsof -i tcp # checking tcp listening connections of localhost sudo lsof -n -P | grep LISTEN netstat -tulpn listing current user’s open processes: sudo lsof -u user_name mounted file system info: mount # info about file systems df -h # file systems info but in human readable format kernel module info, sound driver info: modinfo ufs # kernel module modinfo snd # sound module info user event collection: id Reading ELF file: readelf -h file_name # file header reading running processes: ps aux -ww swap area and disk partition info: cat /proc/partitions # disk partition cat /proc/swaps # swap info kernel message - kernel ring buffer info: dmesg Non-volatile: Collecting system info: cat /proc/cpuinfo cat /proc/self/mounts kernel info: uname -r cat /proc/version hostnamectl | grep Kernel local user account information: cat /etc/passwd cat /etc/passwd | cut -d: -f1 # seperating users from the output logged on user information: w last # login history information collecting system logs: cat /var/log/syslog cat /var/log/kern.log # linux kernel logs cat /var/log/fail.log cat /var/log/mail.* cat /var/log/mysql.* cat /var/log/daemon.log cat /var/log/debug journalctl history and hidden file information: history ls -al # hidden files suspicious info: sudo rkhunter --check --rwo sudo chkrootkit # rootkit checker file signature analysis: xxd file_name | head -n 10 basic file information: file file_name strings -t -d file_name # finding writable files inside /var/log directory : find / -writeable -type f 2> /dev/null | grep "/var/log" Directory permission checking: ls -ld Desktop File system analysis using The Sleuth Kit: Creating an file system image using dd: Important Before that add a virtual hard disk of 1gb for testing purpose on your vm through vmware -> vm settings -> add -> hard disk -> SCSI -> Create new virtual disk -> 1 gb -> Done. ...

Linux allocates unique pseudo (or virtual) numbered device files to represent terminal sessions opened by users on the system. It uses these files to communicate with individual sessions. By default, these files are stored in the /dev/pts (pseudo terminal session) directory. These files are created by the system when a user opens a new terminal session and they are removed on its closure. We can see it via the command tty(teletype)

Volatile data collection: system uptime and current time: In command prompt: (date /t) & (time /t) systeminfo | find "Boot Time" In powershell: (Get-Date) - (gcim Win32_OperatingSystem).LastBootUpTime Network parameters(NetBIOS name cache, active connections, routing table etc): nbtstat -c netstat -ano netstat -rn ipconfig /all Promiscous mode detection on NICs through powershell: Get-NetAdapter | Format-List -Property ifAlias, PromiscuousMode Sysinternal tools: logged on users info: PsLoggedon.exe -x logonsessions.exe -p net sessions net user user_name Hash analysis: Using powershell: Get-FileHash .\FTK_sample_00.E01 -Algorithm MD5 Get-FileHash .\FTK_sample_00.E01 -Algorithm SHA128 Open file information: net file list of running processes, services: tasklist /svc scheduled tasks info: schtasks /query history checking: doskey /history In powershell: ...

The uptime command is used to display the system’s current time, length of time it has been up for, number of users currently logged in, and the average CPU (processing) load over the past 1, 5, and 15 minutes. The output shows the current system time (18:28:09), up duration (49 minutes), number of logged-in users (2), and the CPU load averages over the past 1, 5, and 15 minutes (0.00, 0.00, and 0.00), respectively. The load average numbers correspond to the percentage of CPU load with 0.00 and 1.00 represent no load and full load, and a number greater than 1.00 signifies excess load (over 100%).

You can clear the terminal screen using the command clear .

RHEL provides a set of tools that can be used to identify the absolute path of the command that will be executed when you run it without specifying its full path. These tools are the which, whereis, and type commands. which: whereis: type:

The uname command identifies elementary information about the system including its hostname. uname → shows only the kernel name. uname -a → showing all information Kernel name(1), hostname(2), kernel release(3), date and time of the kernel built(4), machine and hardware name(5), processor type(6), hardware platform(7), operating system name(8). More separate commands to try on uname