LFCA Labs

🎯 Goal: Inspect the systemd journal to see recent system messages

🔍 What is journalctl?
journalctl queries the systemd journal - a centralized log store for kernel, services, and applications. The -n flag limits output. --no-pager prints directly to the terminal (best for exams and scripts).

💻 View last 20 journal entries:
journalctl -n 20 --no-pager

💻 View kernel messages only:
journalctl -k -n 10 --no-pager

🎯 Goal: View logs for a specific systemd service unit

🔍 Unit filtering:
-u filters by systemd unit (service). This is the fastest way to troubleshoot one service without scanning the entire journal.

💻 View SSH daemon logs:
journalctl -u sshd.service -n 15 --no-pager

💻 View cron service logs:
journalctl -u cron.service -n 10 --no-pager

🎯 Goal: Show only error-level and warning-level messages

🔍 Priorities:
Use -p to filter by priority. err focuses on serious problems. Use -b to limit results to the current boot session.

💻 Show error-level messages and above:
journalctl -p err -n 20 --no-pager

💻 Show warnings from the current boot:
journalctl -p warning -b --no-pager

🎯 Goal: Persist logs across reboots using /var/log/journal

🔍 Persistent journald:
Without persistent storage, logs can be volatile. To enable persistence, create /var/log/journal, set Storage=persistent in /etc/systemd/journald.conf, and restart journald.

💻 Create persistent journal directory:
sudo mkdir -p /var/log/journal

💻 Set Storage=persistent:
sudo sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf

💻 Restart journald:
sudo systemctl restart systemd-journald

🎯 Goal: Capture authentication logs in a dedicated file for security review

🔍 Why auth logs?
Authentication events (successful/failed logins, sudo usage) are high-signal security telemetry. A dedicated /var/log/auth.log makes review and forwarding easier.

💻 Create rsyslog rule:
echo 'auth,authpriv.* /var/log/auth.log' | sudo tee /etc/rsyslog.d/50-auth.conf

💻 Restart rsyslog:
sudo systemctl restart rsyslog

🎯 Goal: Confirm journald persistence and auth log file creation

💻 Check journal disk usage:
journalctl --disk-usage

💻 Verify /var/log/auth.log has entries:
sudo cat /var/log/auth.log

🎯 Goal: Review current user and group configuration

💻 Show current user identity:
id

💻 Inspect the end of /etc/group:
cat /etc/group | tail -10

🎯 Goal: Create a new group for developers

💻 Create the developers group:
sudo groupadd developers

💻 Verify the group exists:
getent group developers

🎯 Goal: Create two users with home directories and bash shell

💻 Create alice:
sudo useradd -m -s /bin/bash -G developers alice

💻 Create bob:
sudo useradd -m -s /bin/bash -G developers bob

🎯 Goal: Set initial passwords for alice and bob

💻 Set alice password:
sudo passwd alice

💻 Set bob password:
sudo passwd bob

🎯 Goal: Add alice to the sudo group and verify membership

💻 Add alice to sudo group:
sudo usermod -aG sudo alice

💻 Verify alice group membership:
id alice

🎯 Goal: Confirm bob is in developers and group membership is correct

💻 Verify bob identity:
id bob

💻 Verify developers group members:
getent group developers

🎯 Goal: Confirm Docker is installed and responding

💻 Check Docker version:
docker --version

💻 View Docker engine info:
docker info

🎯 Goal: Download the official Nginx image

💻 Pull the image:
docker pull nginx:alpine

💻 List images:
docker images

🎯 Goal: Run a detached container named webserver and publish port 8080 to 80

💻 Run the container:
docker run -d --name webserver -p 8080:80 nginx:alpine

💻 List running containers:
docker ps

🎯 Goal: Inspect container metadata and view startup logs

💻 Inspect container (JSON):
docker inspect webserver

💻 View container logs:
docker logs webserver

🎯 Goal: Gracefully stop the container and verify it is stopped

💻 Stop the container:
docker stop webserver

💻 Verify with docker ps -a:
docker ps -a

🎯 Goal: Remove the stopped container and confirm cleanup

💻 Remove the container:
docker rm webserver

💻 Confirm there are no containers:
docker ps -a