CompTIA Linux+ Labs

🎯 Goal: Refresh repository metadata and see what's upgradable

📝 What is apt update?
APT (Advanced Package Tool) downloads package lists from repositories configured in /etc/apt/sources.list. This does NOT install anything — it only updates the local index so APT knows what versions are available.

💻 Update the package index:
sudo apt update

💻 List upgradable packages:
apt list --upgradable

🔍 What to look for:
• Packages in the "upgradable" list have newer versions available
• The repository URL shows where the package comes from
• Running apt update regularly prevents stale installs

🎯 Goal: Install both the web server and database server packages

📝 What does -y do?
The -y flag automatically answers "yes" to the confirmation prompt. Without it, APT asks you to confirm before downloading and installing. In scripts, always use -y for unattended installs.

💻 Install Nginx web server:
sudo apt install -y nginx

💻 Install MariaDB database server:
sudo apt install -y mariadb-server

💻 Verify Nginx is installed:
dpkg -l | grep nginx

🎯 Goal: Start the Nginx service and ensure it starts automatically on boot

📝 start vs enable:
• start — runs the service now (this session only)
• enable — tells systemd to start it automatically on boot
• You need BOTH for a service that should always be running

💻 Start Nginx now:
sudo systemctl start nginx

💻 Enable Nginx on boot:
sudo systemctl enable nginx

💻 Check status:
sudo systemctl status nginx

💻 Verify web server responds:
curl http://localhost

🎯 Goal: Start MariaDB and use journalctl to review service logs

📝 What is journalctl?
journalctl reads systemd journal logs. Use -u to filter by service (unit). --no-pager prevents pagination, and -n 10 limits to last 10 entries.

💻 Start and enable MariaDB:
sudo systemctl start mariadb
sudo systemctl enable mariadb

💻 View Nginx logs (last 10 entries):
sudo journalctl -u nginx --no-pager -n 10

🎯 Goal: See all currently running services on the system

💻 List running services:
sudo systemctl list-units --type=service --state=running

🔍 What to look for:
• Both nginx.service and mariadb.service should appear
• The "ACTIVE" column should show "active" and SUB column "running"
• This is how you audit what's running on a production server

🎯 Goal: Practice removing packages and cleaning dependencies

📝 Why autoremove?
When you install a package, it may pull in dependencies. Removing the package doesn't remove dependencies. apt autoremove cleans up orphaned dependencies that are no longer needed.

💻 Stop MariaDB:
sudo systemctl stop mariadb

💻 Remove MariaDB:
sudo apt remove -y mariadb-server

💻 Clean up orphaned dependencies:
sudo apt autoremove -y

🎯 Goal: Understand the current firewall posture before making changes

📝 What is UFW?
UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables. It simplifies firewall management with intuitive commands. iptables is the low-level kernel-level firewall.

💻 Check UFW status:
sudo ufw status verbose

💻 View raw iptables rules:
sudo iptables -L -n

🔍 What to look for:
• UFW status: inactive means NO firewall is protecting you
• iptables shows ACCEPT all by default — everything is allowed in
• This is a major security risk on any public-facing server

🎯 Goal: Configure default deny-incoming / allow-outgoing policy, then activate

📝 Why deny incoming?
The principle of "default deny" means block everything, then explicitly allow only what's needed. This is the gold standard for firewall security — whitelisting, not blacklisting.

💻 Set default deny incoming:
sudo ufw default deny incoming

💻 Set default allow outgoing:
sudo ufw default allow outgoing

💻 Enable the firewall:
sudo ufw enable

🎯 Goal: Open only the ports needed for SSH and web traffic

📝 Port numbers to know:
• Port 22 = SSH (secure remote login)
• Port 80 = HTTP (unencrypted web)
• Port 443 = HTTPS (encrypted web)

💻 Allow SSH access:
sudo ufw allow 22/tcp

💻 Allow HTTP:
sudo ufw allow 80/tcp

💻 Allow HTTPS:
sudo ufw allow 443/tcp

🎯 Goal: Disable root SSH login to prevent brute-force attacks

📝 Why disable root login?
Root is a known username. Attackers try to brute-force root@server first. Disabling root login forces attackers to guess BOTH username and password, making attacks exponentially harder.

💻 Check current SSH config:
cat /etc/ssh/sshd_config | grep PermitRootLogin

💻 Disable root login:
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

💻 Restart SSH to apply changes:
sudo systemctl restart sshd

🎯 Goal: Block Telnet (insecure) and verify all firewall rules

💻 View numbered rules:
sudo ufw status numbered

💻 Check open ports:
ss -tuln

💻 Block Telnet (port 23):
sudo ufw deny 23/tcp

🎯 Goal: Perform a final review of firewall status and login history

💻 Full firewall status:
sudo ufw status verbose

💻 Review login history:
sudo lastlog

🔍 What to verify:
• Default incoming: DENY (not allow)
• SSH (22), HTTP (80), HTTPS (443) are ALLOW
• Telnet (23) is DENY
• Root SSH login is disabled

🎯 Goal: Create a new script file and make it executable

📝 What is a shell script?
A shell script is a text file containing a series of commands. When executed, the shell reads and runs each command in order. The .sh extension is a convention — Linux uses permissions, not extensions, to determine executability.

💻 Create the script file:
touch backup.sh

💻 Make it executable:
chmod +x backup.sh

💻 Verify permissions:
ls -la backup.sh

🎯 Goal: Add the shebang line and backup commands to the script

📝 What is a shebang (#!)?
The #!/bin/bash line (called shebang) tells the system which interpreter to use. Without it, the default shell runs the script. Always include it for portability.

💻 Add shebang line:
echo '#!/bin/bash' > backup.sh

💻 Add backup command:
echo 'tar -czvf /tmp/backup-$(date +%Y%m%d).tar.gz /home' >> backup.sh

💻 Add completion message:
echo 'echo "Backup completed at $(date)"' >> backup.sh

💻 Verify script contents:
cat backup.sh

🎯 Goal: Run the script and verify it creates the backup archive

📝 Running scripts:
You can run a script with bash script.sh or ./script.sh (if executable). Using bash directly doesn't require +x permission — it explicitly calls the interpreter.

💻 Execute the backup script:
bash backup.sh

💻 Verify the backup was created:
ls -lh /tmp/backup*.tar.gz

🎯 Goal: Write a script that checks disk usage and logs a warning

💻 Create monitoring script:
echo '#!/bin/bash' > monitor.sh

💻 Add disk check command:
echo 'df -h / | tail -1 | awk "{print \"Disk usage: \" \$5}"' >> monitor.sh

💻 Add log line:
echo 'echo "Health check completed at $(date)" >> /tmp/monitor.log' >> monitor.sh

💻 Make executable and run:
chmod +x monitor.sh
bash monitor.sh

🎯 Goal: Use crontab to schedule automated execution

📝 Cron syntax:
* * * * * = minute hour day-of-month month day-of-week
Example: 0 2 * * * = every day at 2:00 AM
Example: */5 * * * * = every 5 minutes

💻 Add backup cron job (daily at 2 AM):
echo '0 2 * * * /home/sysadmin/backup.sh' | crontab -

💻 Verify crontab:
crontab -l

🎯 Goal: Confirm the cron daemon is active and will execute your jobs

💻 Check cron service status:
systemctl status cron

🔍 What to verify:
• Active: active (running) — cron daemon is operational
• If stopped, your scheduled jobs won't execute
• The cron daemon checks crontabs every minute