Linux 101

Commonly run Linux commands can be organized into scripts. These files traditionally have a .sh extension. Note that, unlike Windows, Linux doesn't use the file extension to figure out the file type, so you can really name a file whatever you like. In shell scripts a comment begins with # and continues to the end of the line. The first line can contain a special comment called a she-bang "#!" that will cause whatever follows to be run. Create a script with the following content: #!/bin/bashecho $USER likes to use $SHELL Save the file and make it executable (chmod +x <file>). What does this script print?

<username> likes to use <username's shell>

The home directory for Linux is much like the users directory in Windows. Normally this is found in /home/<username>. This is the place to store all of your personal files. Double click on the "Home" icon on your desktop or select "Home" from the "Places" menu in the upper left hand part of the screen. Which of the following directories appear in home?

Downloads Music Desktop Pictures Videos Public Documents

Open a terminal by selecting Terminal from the Applications menu. One of the most common commands used on the Linux command line. Using the ls help screen, man page, or online resources, what does the "ls -al" command do?

It lists all files in the current directory including hidden files in the long listing format.

Run the command "echo trash | nc www.bloomu.edu 80". What is the purpose of this command?

determine if a web server exists at an address and possibly the webserver software

Many commands we have already learned will accept piped input. What does the command 'dmesg|head' do?

displays the first few lines of the device message (dmesg) log

What does the "df -h" command do?

prints available disk space on currently mounted filesystems in a human-readable format

What does the command "uname -a" do?

prints system information such as kernel version and architecture

To log out of Debian one must

select log out from their user name under the menu located in the upper right hand corner of the screen

What is the correct command for installing build-essential on Ubuntu?

sudo apt-get install build-essential

Some packages are not available in the standard repositories, but the package files are available for download. These files are Debian package (.deb) files. Go to https://www.sublimetext.com/3 and grab the 64-bit Debian package. What is the appropriate command to install this package?

sudo dpkg -i sublime*.deb

What does the which command do?

tells the fully qualified path for a program in the user's path

If a user doesn't like the default shell assigned, this is easily changed. The chsh utility is helpful if you want to change your shell. What is the correct syntax to change your default shell to BASH?

chsh -s /bin/bash <username>

Most Linux systems have a temporary directory /tmp that has permissions set wide open so that any users can use this as scratch space. From your home directory enter "echo Hello >test.txt". This will create the file test.txt. Now enter "cp -p ~/test.txt /tmp/.". What does this command do?

copies the file test.txt from the home directory to /tmp while preserving permissions and timestamps

Like DOS/Windows, Linux uses a PATH environment variable to locate programs whenever you type their names into the shell. The PATH variable contains a colon separated list of directories that are searched whenever a command or program name is entered. It is common for new programs to add to the PATH when they are installed. The easiest way to do this is something like PATH=$PATH:$HOME/bin. Notice that in Linux it is OK to reset a variable by referencing its old value. Because the PATH can be quite long, it may not be obvious which program is being executed if there are duplicates. The which command allows you to see the exact path to the program which occurs first in your path. What is the full path to the sudo command?

/usr/bin/sudo

Sometimes you need to kill or stop a process. For most programs there is a key you can press that will stop a process or script. Run the following command "while true; do echo Hello; done". Which of the following keys will stop this script?

Control-C

Only the administrator (root) can access the Users settings applet.

False

Based on what you see in the "Internet" menu under "Applications", what appears to be the standard browser for Debian/Ubuntu?

Firefox

The cat (concatenate) command in Linux can be used for many things. It can concatenate files together by typing "cat file1 file2". It can display the contents of a single file by typing "cat file". It can also be used like "copy con" in DOS/Windows to create a simple file without an editor. Use cat to create a simple file by typing "cat >test.sh" from your home directory and then entering the following: #!/bin/bash echo Hello $(whoami) Enter Control-D to tell cat you are done entering the file. You should see a newly created file. When you do a ls on your home directory the file will show up as black, because it is not marked as executable. To fix that type "chmod +x test.sh". Now if you run ls it should show up as green. Run the file by typing "./test.sh". What is displayed?

Hello <BU username>

Linux is highly configurable. You can access the system settings by selecting Applications->System Tools->Settings. You should see a bunch of settings applets sorted by type. Unless you have administrator (root) access you will not be able to change all of these items. Which of the following are in the same group?

Network, Bluetooth

The Linux mv (move) command can be used to move files from place to place. Because of the way Linux filesystems work, this is much more efficient that moving files in Windows/DOS (especially on FAT partitions). Change to your home directory and move the file created earlier by typing "mv -n test.txt /tmp/test.txt". What is the result of running this command?

Nothing, a file by that name already exists in /tmp and the no clobber option was used

What is the purpose of the pwd command?

Print the current (working) directory

The cd command is much like the command with the same name on Windows/DOS with a few exceptions. Just like DOS, paths can be relative or absolute. Most Linux terminals are configured to display the current directory in the prompt with "~" used to represent the home directory. From the terminal change to the /etc directory by typing "cd /etc". You should notice your prompt change. Now type "cd apt" which should put you in /etc/apt and change your prompt. Now type "cd". What does the "cd" command (with no arguments) do in Linux?

Returns to the home directory

Linux is sometimes called GNU/Linux. GNU stands for GNU is Not Unix. GNU has a host of applications. Perhaps the most important GNU product is GCC, the GNU Compiler Collection. Select "Graphics" from the "Applications" menu. Based on what you see, what is the GNU application included with Debian used to edit images?

The GNU Image Manipulation Program (GIMP)

A typical Linux system has many processes running at any given time. It is good to know what is running and who has started a particular process. The first two processes created when a system boots are given IDs 1 and 2. Process 1 is normally running '/sbin/init'. Every other process has a parent process that created it with the ultimate parent being either process 1 or 2. The ps command is used to list processes. What would be the purpose of passing "-Fu" as an option to ps?

This will produce an extra full listing of processes for a given user.

Linux distributions (distros) normally ship with an office suite. There are two common open source suites available. One is called OpenOffice. The other, which is a fork of OpenOffice is known as LibreOffice. LibreOffice is preferred by many Linux users and is automatically installed in Debian. Open LibreOffice Writer. Does this application allow documents to be saved in the latest MS Office format (.docx)?

True

Login to your Linux machine with your standard university username/password. Were you successful?

True

Sometimes you have to download source code and build it. Often this is not as difficult as it seems at first. Either you can download an archive or you might be able to grab the source code from github.com. Download MDK3 using the following command: git clone https://github.com/wi-fi-analyzer/mdk3-master Now build the program using make. True or False: To install this tool you must run 'sudo make install'.

True

Unlike Windows, Linux is very flexible and the user is free to choose the windowing environment (including none), the shell, installed applications, etc. The default windowing environment for Debian is Gnome. Click on the "Applications" menu in the upper left hand corner then select "Accessories". Open the gedit application. Gedit is the Gnome editor. It may look simple, but it is actually a very powerful editor that is aware of the type of files it is editing. It supports syntax highlighting and many other features. What is the title in the title bar when you first launch this application?

Untitled Document 1

The ampersand (&) can be added to any command in order to run it in the background. This is useful for launching GUI (graphical) programs without tying up your terminal. Be careful not to run interactive command line programs this way as they might end up orphaned until you kill them. Run the command "gedit &" two (2) times. What is displayed in the terminal?

[1] <process number>

In Linux filesystems are mounted. What this means is that their files are made available under a certain directory known as a "mount point". Note that, unlike Windows, no silly drive letters are assigned based on random values such as how the drive is connected. The system administrator has total control to mount a filesystem anywhere he or she sees fit. The mount command is used to mount a new filesystem. What happens if a normal user runs this command with no arguments?

a list of all currently mounted filesystems is displayed

Sometimes a process can't be killed with a key press. In those cases you might need to send a kill signal. One convenient way to do this is the killall command. Run gedit by typing "gedit &". What happens if you now run "killall ged"?

an error message is displayed that there is no such process

The wc utility is often used with pipes. What is the purpose of the command "ls -lR | wc -l"?

approximate the number of files at or below the current directory

What does the command "du -s ./" do?

prints the disk space used by files in the current directory and below

What is the purpose of the tee command?

save standard output to a file while preserving the stream

The easiest packages to install are in standard repositories. One such package is called build-essential. This package is needed to build many tools from source code. apt-cache can be used to find out about packages in currently installed repositories. Which apt-cache option can be used to get information about the build-essential package?

showpkg

Sometimes it is useful to know if anyone else is logged on to a system. One command for displaying this information is who. Another command is w. What is the difference between these two commands?

who displays logged in user. w displays logged in users and their last command.

You will notice that the command prompt normally looks something like: [user@localhost ~]$ This behavior in bash is set by the PS1 environment variable. The normal default PS1 is something like [\u@]h \W]\$ on RHEL. Other distributions have different defaults, but the user@host followed by the current directory is pretty common. To change the prompt, just changed the $PS1 variable. For example PS1='By your command \u\$'. If you launch another shell from within the current shell you will once again have the defaults. You can propogate these changes to child processes by exporting the variable after setting it with "export PS1". Here are some items you can use in PS1 What PS1 string would produce a prompt like the following? #ppolstra@localhost@Tue Aug 23 ~/bin?

#\u@\h@\d \W?

he rm (remove) command is used to get rid of files when they are no longer needed. Just like Windows, the file contents are still there, but the space is marked as available. A secure remove (srm) tool is available for Linux for getting rid of sensitive files. Let's get rid of the test.txt file in /tmp by typing "rm /tmp/*". You will be prompted about whether or not to remove some write-protected files. Say no at each prompt. What option(s) could have been used to prevent all the prompts?

-f or --force which would have removed all files without prompting

It is often useful to look at the top (head) or bottom (tail) of a file. Many of the log files on Linux are stored in the /var/log directory. Here var stands for variable, as in the contents are expected to change. One log file that pertains to devices on a system is called dmesg. List the first few lines of dmesg by typing "head /var/log/dmesg". You should likely see some information about the exact version of Linux being run, including the version of GCC in use. Now run "tail /var/log/dmesg" to see the end of the file. You should see information on the last plugged in device. If you plugged in a new device you could rerun the tail command in order to see the new messages. What option(s) could be used for the tail command to automatically display new lines as they appear?

-f or --follow

Which settings applet is used to change the desktop wallpaper?

Background

The shell is a place from which commands are launched. Just like most things in Linux, there are choices of shells. Don't confuse a shell with a windowing system. There are lots of choices there as well (including the command line only option). You can think of a shell much like the Windows/DOS command prompt. The original shell was the Bourne shell. The executable for this shell is simply sh. A more capable shell known as the Korn shell (ksh) was developed by David Korn at Bell Labs. The Bourne-Again SHell (bash) was released in 1989 and has become the default shell for most Linux systems today. There are a lot of alternative shells available, far too many to list here. Environment variables in Linux are referenced by preceding them with a $ (In DOS/Windows a % is used before and after the name). These environment variables are used for many things, including the shell is use. All environment variables can be listed using the env command. Each variable can be listed separately using "echo $VARIABLE". Note that the variable names are case sensitive. The $SHELL variable holds the current shell. What is the default shell on the lab computers?

Bourne shell (sh)

The advantages of Linux over Windows as a forensics platform are too numerous to list. One of the nice features of Linux is that it does not rely on something as silly as file extensions to determine what a file is. Rather, Linux has a large built-in database of many file types. This functionality is exported via the file command. Run the file command on the test.sh file by typing "file test.sh". What are the results?

Bourne-Again shell script, ASCII text executable

If the system clock is not set correctly, file timestamps can be wrong. This can lead to some confusion. When doing live forensics on any system the system clock should always be checked. What does the date command do?

display the current date and time

What does the time command do?

displays the run time for a command

Part of the Unix/Linux philosophy is to provide a large number of utilities that can be connected together with pipes. To pipe the output from command 1 to command 2 simply type 'command1 | command2'. Run the command 'ls -lR ~/ |less'. From running this command, what is the purpose of less?

less seems to be a different version of more

What is the purpose of the command "ls -i | sort -n"?

list the inodes used to store files in the current directory in ascending order

What does the lspci command do?

lists PCI bus devices installed

What does the command "file * | grep Bourne-Again" do?

lists all bash shell scripts in the current directory

What does the lsusb command do?

lists currently connected USB devices

There is no limit on the number of commands that can be piped together.

lists packages having to do with python libraries in alphabetical order

Some packages that come as source code use a configure script. The purpose of this script is to check that all required packages are installed and to generate the Makefile from a template (Makefile.in). Download Ruby from https://www.ruby-lang.org/en/downloads/ Ruby is a popular scripting language (not as popular as Python at the moment). After downloading, extract the files and run the configure script. Once the configure script runs successfully, what command would build and then install Ruby?

make && sudo make install

Grep the GNU Regular Expression Parser is a very powerful tool. With a full understanding of regular expressions many searching tasks become easy. Even without much regular expression knowledge some tasks are very simple. What does the command "apt search python | grep lib" do?

shows Python packages listed as available only including packages having to do with libraries

Unlike Windows, Linux provides standard tools that can easily help identify processes that are bogging down a system. One of these tools is top. Run top on your system (pressing Q will exit top when you are done). Which of the following is not displayed in the standard top screen?

total threads

Run the command "echo eleet | tr elt 317". Based on the results of this command, what is one possible use of tr for forensics and security?

translating passwords in a list to "leet speak" when performing password cracks

There are several files that are automatically run when you first log in or create a shell. These files are normally located in the home directory. Most of the time there are hidden files and/or stored in hidden directories. Recall that files beginning with a period are hidden. For the bash shell, the .bashrc configuration file is most commonly used to load any user customizations. These files often reference other files in the /etc directory that hold system defaults. Modify your .bashrc file and add the following line at the bottom: alias upd='sudo apt update && sudo apt upgrade' You will need to source the .bashrc file by typing ". .bashrc" to make these changes effective. What does this new line do?

updates repositories and also all currently installed packages