Incident guide · Security
Linux security and access cheat sheet
Inspect SSH, firewall, audit, SELinux, AppArmor, Fail2ban, certificates, and access policy without silently changing enforcement.50explained commands2practical sections100%concrete examples
25
Identity and remote access
Confirm identity, login history, SSH resolution, and certificate evidence.
Show the current user and group identitiesidRead-only
List active login sessionsloginctl list-sessionsRead-only
Show the effective OpenSSH client configuration for a hostssh -G <host> | sortRead-only
Print effective SSH client settings for a hostssh -G <host> | rg '^(hostname|user|port|identityfile|proxyjump) 'Read-only
Print a certificate SHA-256 fingerprintopenssl x509 -in <certificate> -noout -fingerprint -sha256Read-only
Show system uptime and load averagesuptimeRead-only
Print kernel, architecture, and system informationuname -aRead-only
List environment variables alphabeticallyenv | sortRead-only
Print the current time in ISO 8601 formatdate -IsecondsRead-only
Show recent system reboot historylast reboot | head -10Read-only
Inspect a remote TLS certificateopenssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesRead-only
Calculate the SHA-256 checksum of a filesha256sum <file>Read-only
Add executable permission to a filechmod +x <file>caution
Generate a cryptographically random Base64 passwordopenssl rand -base64 <count>Read-only
Calculate how many days remain on a remote TLS certificateend=$(openssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2); echo "notAfter=$end"; echo "daysRemaining=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))"Read-only
Print subjects, issuers, and validity dates for a TLS chainopenssl s_client -showcerts -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -nooutRead-only
Show the negotiated TLS protocol, cipher, and peer certificateopenssl s_client -brief -connect <host>:<port> -servername <host> </dev/null 2>&1 | rg 'Protocol|Ciphersuite|Peer certificate|Verification'Read-only
Show the latest failed login attempts with source addressessudo lastb -Fai | head -<count>caution
Audit world-writable files without crossing filesystemssudo find <path> -xdev -type f -perm -0002 -printf '%M\t%u:%g\t%p\n' | sortcaution
Inventory SUID and SGID executables on one filesystemsudo find <path> -xdev -type f \( -perm -4000 -o -perm -2000 \) -printf '%M\t%u:%g\t%p\n' | sortcaution
Show all WireGuard interfaces, peers, endpoints, and trafficsudo wg show allRead-only
Show the latest WireGuard handshake timestamp for every peersudo wg show all latest-handshakesRead-only
Show WireGuard receive and transmit counters for every peersudo wg show all transferRead-only
Show recent OpenVPN service logsjournalctl -u openvpn --since <since> --no-pagerRead-only
List established strongSwan IKE and IPsec security associationssudo swanctl --list-sasRead-only
25
Firewall and policy enforcement
Read active rules and recent denials before changing controls.