Master Linux: Quick Commands to Spot Rogue Processes, Backup, and Harden Your System

Identify Processes Not Run by You

Difficulty: Advanced Application: bash (UNIX/Linux shell)

List all processes that are not owned by your user: ps aux | grep -v `whoami` Or show the top ten CPU‑intensive processes (run as root for best results):

ps aux --sort=-%cpu | grep -m 11 -v `whoami`

Simple Website Backup with rsync

Difficulty: Easy Application: Backups

Copy only changed files from a remote directory to a local backup using rsync over SSH:

rsync -avere ssh [email protected]:/home/jono/importantfiles/* /home/jono/backup/

Find the Largest File

Difficulty: Easy Application: Shell

List files in the current directory sorted by size, largest last, with human‑readable output: ls -lSrh Search for the largest MP3/MPEG files: ls -lSrh *.mp* Find the largest directories:

du -kx | egrep -v "\./.+/" | sort -n

List Only Today’s Files

Difficulty: Easy Application: Various

Show files created today using a combination of ls and grep with the current date:

ls -al --time-style=+%D | grep `date +%D`

Transfer Files Without FTP or SCP (netcat)

Difficulty: Easy Application: netcat

On the destination machine, listen and extract the incoming archive: nc -l -p 1234 | uncompress -c | tar xvfp - On the source machine, compress and send the directory:

tar cfp - /some/dir | compress -c | nc -w 3 [destination] 1234

Backup Your Boot Sector

Difficulty: Advanced Application: Shell

Create a backup of the first 512 bytes of the boot device: dd if=/dev/hda of=bootsector.img bs=512 count=1 Restore it later:

dd if=bootsector.img of=/dev/hda

Protect Log Files

Difficulty: Advanced Application: Various

Set the immutable “append‑only” attribute so logs cannot be deleted and can only be appended to: chattr +a /var/log/logfile Demonstration:

touch /var/log/logfile

echo "append‑only not set" > /var/log/logfile

chattr +a /var/log/logfile

echo "append‑only set" > /var/log/logfile

Attempting to overwrite now fails, but appending works: echo "appending to file" >> /var/log/logfile To prevent even root from removing the attribute, disable the CAP_LINUX_IMMUTABLE capability using the lcap tool: tar xvfj lcap-0.0.3.tar.bz2 && cd lcap-0.0.3 && make Then run:

./lcap CAP_LINUX_IMMUTABLE

./lcap CAP_SYS_RAWIO

Adding these commands to your boot scripts (e.g., /etc/rc.local) ensures the protection persists across reboots.