DEV Community: Carlos Leonel Ramirez

My Linux Upskill Challenge: Day 9

Carlos Leonel Ramirez — Fri, 06 Jun 2025 18:11:56 +0000

This lesson is about an introduction to networking controls, including securing ports and basic firewall configuration.

Checking Open Ports

To check which ports are open on the server, we can use the following tools:

ss — stands for socket status , a modern replacement for the old netstat.
nmap — a powerful port scanner , not usually installed by default.
To show which ports are open and on which interfaces:
Current output on my Ubuntu server, I only have ports 22(ssh) and 80 (http) open.
Another tool that we can use to check open ports is nmap, this tool is more intended to scan port on a remote machine, but we can use it to scan our own server (localhost).
nmap can scan more than 1,000 ports to see if they’re open. But heads up — firewalls might see this as suspicious behavior and block your IP. So use it carefully, especially in your own network.
nmapwas not present by default on my ubuntu machine, so I installed using sudo apt install nmap, then I run:
The results showed with the localhost (127.0.0.1) IP could be incomplete, because this shows you only the service that are bounded to you local interface.
If you want to be sure of what is really exposed, you should use the actual IP interface on the network card and use nmapwith that.
To find you the IP address of your network card use:
And scan again with your actual IP address, In my case the result turned out to be the same, but on real world scenario could differ

Linux firewall

Linux has a built-in firewall directly on its kernel called Netfilter , don’t think it as a tool or a command, instead is something included on its core, as a backend system.

There are different ways to “interact” or configure Netfilter , one of older and most-used is iptables , is still used but now it’s considered legacy.

A more modern alternative is nftables , that was introduced in Linux 3.13+

iptables and nftables can’t be used at the same time unless you very sure what you’re doing because they may conflict.

To view the iptables current rules use this command:

🔎 iptables output explained

Let’s break this output down. When you run sudo iptables -L, you’re asking iptables to list the current rules in the filter table , which is the default table used for firewall rules.

Chain INPUT (policy ACCEPT)
target prot opt source destination

🔹 Chain: `INPUT`

Handles incoming traffic to your system.
Example: SSH requests, web traffic to a server on port 80/443, etc.
Policy: ACCEPT → If no rules match, allow the packet by default.

Chain FORWARD (policy ACCEPT)
target prot opt source destination

🔹 Chain: `FORWARD`

Handles traffic that’s passing through your system , not destined for it.
Example: If your Linux box is acting as a router or gateway.
Policy: ACCEPT → Forward everything by default.

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

🔹 Chain: `OUTPUT`

Handles outgoing traffic generated by your system.
Example: You using curl or apt to reach external servers.
Policy: ACCEPT → Allow all outgoing traffic by default.

Output Summary

Currently I have no firewall rules set in iptables.
The default policy is “ACCEPT” , so everything is allowed :
- Any service can receive inbound traffic (INPUT)
- Forwarding traffic is allowed (FORWARD)
- Your system can initiate outbound connections (OUTPUT)

In addition to the default filter table (used for basic firewall rules), iptables supports several other tables — each with a specific purpose, some examples are: nat , mangle , raw , security.

Uncomplicated Firewall (UFW)

UFW it’s a frontend that helps us to configure the firewall rules on a more easy way, it’s present mostly on Ubuntu/Debian systems.

Under the hood, it manages the iptables configuration (or nftables in newer systems.)

ufwis available by default in all Ubuntu installations after 8.04 LST, but if you need to install it, use:
To check the current status of UFW run

In my case it was disabled by default

❯ sudo ufw status verbose
Status: inactive

To allow SSH but deny HTTP we would type
Then enable UFW with this:

TIP

Be sure to ALLOW ssh, of you will loose contact with your remote server

After enabling UFW, if you run iptables -L again, you’ll see UFW-created rules like:

Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpt:http

To re-allow HTTP traffic:

sudo ufw allow http
sudo ufw enable

Changing default ssh port

ometimes it’s a good idea to change the default SSH port (22) to something else like 2222. This can be done by editing:

/etc/ssh/sshd_config

This is called “security through obscurity.” It’s not a strong defense by itself, but can help avoid automated scans.

Conclusions

This lesson covered the basics of checking open ports and using firewalls to secure Linux servers. It focused on practical tools (ss, nmap, iptables, ufw) and basic firewall configurations.

This is not an in-depth guide — for more advanced usage, consult the official documentation or community tutorials.

➡️ Previos Lesson: Day 8

My Linux Upskill Challenge: Day 8

Carlos Leonel Ramirez — Thu, 05 Jun 2025 17:30:36 +0000

Following the Linux Upskill Challenge: Day 8

This is my notes for the Day 8 Lesson - Text Analysis Tools

Introduction

This lesson covers the most important Linux commands for viewing, exploring, and manipulating text files. These small but powerful tools are incredibly useful when you need to explore and analyze large text files created by applications, user logs, and other system files.

Sample Log File Setup

For this practice session, I asked ChatGPT to generate an Apache access log sample file with different sources and scenarios to test various combinations and common sysadmin use cases. In real-world scenarios, you’d work with actual access log files.

File location: /var/log/apache2/sample_access.log

192.168.1.10 - - [05/Jun/2025:18:01:01 -0600] "GET / HTTP/1.1" 200 720 "-" "curl/8.4.0"
10.0.0.2 - - [05/Jun/2025:18:01:03 -0600] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0"
172.16.5.5 - - [05/Jun/2025:18:01:04 -0600] "POST /login HTTP/1.1" 302 512 "http://myserver.com" "Mozilla/5.0 (Linux; Android 11; SM-G973U) Chrome/122.0.0.0 Mobile"
192.168.1.15 - - [05/Jun/2025:18:01:07 -0600] "GET /api/data HTTP/1.1" 200 2048 "-" "PostmanRuntime/7.30.0"
203.0.113.12 - - [05/Jun/2025:18:01:10 -0600] "GET /docs/index.html HTTP/1.1" 200 1560 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
192.168.1.10 - - [05/Jun/2025:18:01:14 -0600] "GET / HTTP/1.1" 200 720 "-" "curl/8.4.0"
192.168.1.15 - - [05/Jun/2025:18:01:16 -0600] "GET /favicon.ico HTTP/1.1" 404 230 "-" "PostmanRuntime/7.30.0"
10.0.0.2 - - [05/Jun/2025:18:01:20 -0600] "GET /dashboard HTTP/1.1" 200 1800 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Edge/115.0.0.0"
198.51.100.99 - - [05/Jun/2025:18:01:25 -0600] "GET /admin HTTP/1.1" 403 890 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_6_1) Safari/537.36"
10.10.10.1 - - [05/Jun/2025:18:01:28 -0600] "POST /upload HTTP/1.1" 500 10240 "-" "curl/8.3.0"
172.16.5.5 - - [05/Jun/2025:18:01:31 -0600] "GET /api/stats HTTP/1.1" 200 4096 "-" "Mozilla/5.0 (Linux; Android 11) Chrome/123.0.0.0 Mobile"
203.0.113.12 - - [05/Jun/2025:18:01:33 -0600] "GET /dashboard HTTP/1.1" 200 1800 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/121.0"
192.168.1.10 - - [05/Jun/2025:18:01:36 -0600] "GET /secret HTTP/1.1" 401 720 "-" "curl/8.4.0"
198.51.100.99 - - [05/Jun/2025:18:01:40 -0600] "GET /admin HTTP/1.1" 403 890 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_6_1) Safari/537.36"
10.10.10.1 - - [05/Jun/2025:18:01:45 -0600] "GET /static/image.png HTTP/1.1" 200 2048 "-" "Wget/1.21"
10.10.10.2 - - [05/Jun/2025:18:01:48 -0600] "GET /static/image.png HTTP/1.1" 200 2048 "-" "Wget/1.21"
192.168.1.15 - - [05/Jun/2025:18:01:50 -0600] "GET /login HTTP/1.1" 200 1024 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) Chrome/130.0.0.0"

Core Text Analysis Tools

`cat` - Display File Contents

Dumps the complete content of a file to the terminal:

cat /var/log/apache2/sample_access.log

Best for: Small files or when you need to see the entire content at once.

`less` - Interactive File Viewer

Opens a text file for interactive navigation with keyboard controls:

less /var/log/apache2/sample_access.log

Navigation shortcuts:

Arrow keys or j/k: Move up/down line by line
gg: Jump to the beginning of the file
G: Jump to the end of the file
/pattern: Search for text patterns
n/N: Jump to next/previous search result
q: Quit

Best for: Large files where you need to browse through content interactively.

`tail` - View File Endings

Displays the last part of a file (default: last 10 lines):

# Basic usage - last 10 lines
tail /var/log/apache2/sample_access.log

# Specify number of lines
tail -n 5 /var/log/apache2/sample_access.log

# Follow file in real-time (great for monitoring logs)
tail -f /var/log/apache2/sample_access.log

Tip: Use Ctrl+C to exit the -f (follow) mode.

Best for: Monitoring active log files or checking the most recent entries.

`head` - View File Beginnings

Similar to tail, but shows the first lines of a file:

# First 10 lines (default)
head /var/log/apache2/sample_access.log

# First 5 lines
head -n 5 /var/log/apache2/sample_access.log

Pattern Matching and Filtering

`grep` - Search Text Patterns

Filters lines containing specific text patterns (supports regular expressions):

# Basic search
grep "Mozilla" /var/log/apache2/sample_access.log

# Case-insensitive search
grep -i "curl" /var/log/apache2/sample_access.log

# Search for specific requests
grep "favicon.ico" /var/log/apache2/sample_access.log

# Exclude lines matching a pattern
grep -v "Chrome" /var/log/apache2/sample_access.log

# Show line numbers
grep -n "404" /var/log/apache2/sample_access.log

The Power of Pipes (`|`)

The pipe symbol | is fundamental to Unix philosophy - it lets you chain commands by passing the output of one command as input to another.

Basic Pipe Examples

# View IP addresses and scroll through them
cut -d" " -f1 /var/log/apache2/sample_access.log | less

# Filter for Chrome browsers, then show only macOS users
grep "Mozilla" /var/log/apache2/sample_access.log | grep "Macintosh"

# Exclude Chrome traffic from Mozilla browsers
grep "Mozilla" /var/log/apache2/sample_access.log | grep -v "Chrome"

# Find Apache processes (system administration example)
ps aux | grep apache2

Data Extraction and Manipulation

`cut` - Extract Columns/Fields

Extracts specific sections from delimited text:

# Extract first field (space-delimited)
cut -d" " -f1 /var/log/apache2/sample_access.log

# Extract multiple fields
cut -d: -f1,3,5 /etc/passwd

# Extract field ranges
cut -d: -f1-3 /etc/passwd # Fields 1 through 3
cut -d: -f4- /etc/passwd # Field 4 to end

# Extract by character position
cut -c1-10 myfile.txt # First 10 characters

Example with /etc/passwd:

# Show usernames only
tail /etc/passwd | cut -d: -f1

# Show username, UID, and home directory
cut -d: -f1,3,6 /etc/passwd

`sort` - Arrange Lines

Orders lines alphabetically or numerically:

# Basic alphabetical sort
sort names.txt

# Numeric sort in reverse order
sort -nr numbers.txt

# Sort by specific column (space-delimited)
sort -k2 file.txt

# Sort CSV by third column numerically
sort -t ',' -k3 -n data.csv

`uniq` - Remove Duplicates

Removes consecutive duplicate lines (usually used with sort):

# Remove duplicates
sort file.txt | uniq

# Count occurrences of each line
sort file.txt | uniq -c

# Show only duplicated lines
sort file.txt | uniq -d

Advanced Text Processing

`awk` - Pattern Scanning and Data Extraction

Powerful tool for processing structured text data:

# Print specific columns (fields)
awk '{print $1}' /var/log/apache2/sample_access.log # IP addresses
awk '{print $4, $5}' /var/log/apache2/sample_access.log # Date and time

# Filter by conditions
awk '$9 == 404' /var/log/apache2/sample_access.log # 404 errors only
awk '$NF > 1000' /var/log/apache2/sample_access.log # Large responses

# Custom formatting
awk '{print "IP: " $1 ", Status: " $9}' /var/log/apache2/sample_access.log

`sed` - Stream Editor

Search, replace, and edit text on-the-fly:

# Replace text (first occurrence per line)
sed 's/curl/CURL/' /var/log/apache2/sample_access.log

# Replace all occurrences
sed 's/curl/CURL/g' /var/log/apache2/sample_access.log

# Delete lines containing specific text
sed '/curl/d' /var/log/apache2/sample_access.log

# Show only matching lines
sed -n '/Mozilla/p' /var/log/apache2/sample_access.log

Warning: Use sed -i (in-place editing) carefully - it modifies the original file!

Output Redirection

Save Output to Files (`>`)

Redirect command output to files instead of the terminal:

# Create/overwrite file
ls -ltr > listing.txt

# Append to file
echo "New entry" >> listing.txt

# Redirect errors to file
command 2> errors.log

# Redirect both output and errors
command > output.log 2>&1

Practical Log Analysis One-Liners

🔍 Top Visitor IPs

cut -d' ' -f1 /var/log/apache2/sample_access.log | sort | uniq -c | sort -nr

📂 Request Methods Analysis

cut -d'"' -f2 /var/log/apache2/sample_access.log | cut -d' ' -f1 | sort | uniq -c

🧑‍💻 User-Agent Analysis

cut -d'"' -f6 /var/log/apache2/sample_access.log | sort | uniq

📊 HTTP Status Code Breakdown

cut -d'"' -f3 /var/log/apache2/sample_access.log | cut -d' ' -f2 | sort | uniq -c

🔐 Find Failed Access Attempts

grep -E ' (401|403) ' /var/log/apache2/sample_access.log

🌐 Filter by Browser Type

grep -i "chrome" /var/log/apache2/sample_access.log

📄 Most Requested Paths

cut -d'"' -f2 /var/log/apache2/sample_access.log | cut -d' ' -f2 | sort | uniq -c | sort -nr

🔍 Find 404 Error Paths

grep ' 404 ' /var/log/apache2/sample_access.log | cut -d'"' -f2 | cut -d' ' -f2

⏰ Traffic by Hour

cut -d'[' -f2 /var/log/apache2/sample_access.log | cut -d':' -f2 | sort | uniq -c

Advanced Analysis Examples

Most Active IPs with Request Count

cut -d' ' -f1 /var/log/apache2/sample_access.log | sort | uniq -c | sort -nr | head -10

Browsers Causing Most Server Errors

grep " 5[0-9][0-9] " /var/log/apache2/sample_access.log | cut -d'"' -f6 | sort | uniq -c | sort -nr

Traffic Analysis by Time Period

cut -d'[' -f2 /var/log/apache2/sample_access.log | cut -d']' -f1 | cut -d':' -f1-2 | sort | uniq -c

Large Response Analysis

awk '$NF > 2000 {print $1, $NF, $7}' /var/log/apache2/sample_access.log | sort -k2 -nr

Key Takeaways

These text processing tools become incredibly powerful when combined. The Unix philosophy of “do one thing well” means you can chain simple commands to perform complex analysis tasks. Practice chaining these commands with pipes to build your own custom analysis workflows.

Remember: always test your commands on sample data before running them on important production logs!

External Resources

Related Notes

Previous Lesson: My Linux Upskill Challenge: Day 7
Next Lesson: My Linux Upskill Challenge: Day 9

Nota diaria: 2025-06-05

My Linux Upskill Challenge: Day 7

Carlos Leonel Ramirez — Tue, 27 May 2025 07:15:30 +0000

Introduction

This is my journal note following the Linux Upskill Challenge: Day 7.

Before we Begin

In this lesson, we explore how services work in Linux, how they're configured, and where to find their logs. The example used is installing and experimenting with the Apache2 web server.

Installing Apache2 on Ubuntu

  sudo apt update
  sudo apt install apache2

How to verify Apache is running

Open your browser and go to http://<server-ip> or use curl in the server terminal:

  curl http://localhost

[!Note]
If you'r using an cloud hosted virtual machine, you will probably need to do extra steps in order to allow incoming request to you server on the port 80, perhaps this guides will help you:

AWS

Azure

GCP

Oracle Cloud Infrastructure

Understanding Services in Linux

What is a service in Linux?

A service is a background process (also called a daemon) that is managed by the system to start, stop, or restart as needed.
In our case apache2 applications is running as a "service" inside Linux.

How are services managed?

On modern systems like Ubuntu, services are managed using systemd via the systemctl command.

Process, Daemons, Services, and Units

Process

A process is a running instance of a program.
For example, if you have a Bash script in your home folder, that's just a file — it does nothing until you execute it.
When you run the script, a process is created (with a Process ID or PID) and it starts using system resources. So a process is the live, running version of a program.
You can even run the same program (or script) multiple times — each execution creates a new, separate process.

Every process has its own Process ID (PID).

Daemon

A daemon is a process that runs in the background and typically does not interact directly with the user.
Daemons usually start when the system boots and continue running “silently” in the background. They often handle essential tasks like logging, printing, networking, or system services like SSH.
There’s a naming convention where many daemons end with the letter d, such as sshd, systemd, or httpd. However, this is not a strict rule — some daemons like cron, cups, or rsyslog don’t follow this pattern.

Service

When a daemon is managed by the system’s init system (like systemd), it’s typically referred to as a service. This means it has an associated unit file that defines how to start, stop, and monitor it.
Examples of daemons that run as managed services include: httpd (Apache), nginx (Nginx), and docker (Docker).
To understand the difference, think of it this way: not every daemon is a service — meaning there can be background daemons that are not managed by the init system (like systemd). These may be started manually or by other programs.

Unit

systemd manages units — a unit is a representation of a resource that needs to be controlled.
Simply put, a unit is something that systemd organizes and keeps track of.
There are different types of units depending on the resource they describe or represent.
One of the most common unit types is the service unit (.service), which defines how to manage a service or application. It includes instructions on how to start or stop the service, when it should be started automatically, and any dependencies or ordering with other software.
Other unit types include: .socket, .mount, .automount, .swap, .target, .path, .timer, .snapshot

For example, a .service unit describes how to manage a system service like apache2, while a .mount unit tells systemd how to handle mounting a filesystem.

Units are defined using configuration files called unit files.

What is systemd ?

systemd it's the core init system used in most modern Linux distributions (like Ubuntu, Debian, Fedora, RHEL, etc.).
It's the background process that manages all the services and other processes that are running on your system.
It's like the 🧠 brain, or🗼 Control Tower of everything that is running on Linux
It is the first process (PID 1) that runs after the Linux kernel finishes booting.
Its job is to initialize the system, start all necessary services, and manage them during runtime.

Other Linux distribution (specialy oldest) could have a different init systems, like OpenRC, Upstart, etc..

The command `systemctl`

systemctlis the command line tool to interact with systemd
You use systemctlto start/stop/enable/disable services, among other things.
So systemctlis the user-facing CLI tool to manage systemd.

Start and Stop services

You can use this commands to start and stop the Apache2 service.

sudo systemctl start apache2
sudo systemctl stop apache2

Restart and Reload services

To restart a running service, you can use the restart command:

sudo systemctl restart apache2

You can also reload a service with the reload command, this means that the application will be able to reload its configuration files (without restarting):

sudo systemctl reload apache2

Check status

In case you want to check the status you should use:

systemctl status apache2

You should observe sometime like this if the service is running OK

● apache2.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; preset: enabled)
     Active: active (running) since Tue 2025-05-27 21:55:51 CST; 12h ago
       Docs: https://httpd.apache.org/docs/2.4/
    Process: 6291 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
   Main PID: 6294 (apache2)
      Tasks: 55 (limit: 4549)
     Memory: 5.6M (peak: 6.3M)
        CPU: 2.565s
     CGroup: /system.slice/apache2.service
             ├─6294 /usr/sbin/apache2 -k start
             ├─6296 /usr/sbin/apache2 -k start
             └─6297 /usr/sbin/apache2 -k start

May 27 21:55:51 ubuntu systemd[1]: Starting apache2.service - The Apache HTTP Server...
May 27 21:55:51 ubuntu apachectl[6293]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, >

Enabling and Disabling Services

To enable a service to start automatically on boot, use the enable command:

sudo systemctl enable apache2

To disable a service for automatic start, you can use:

sudo systemctl disable apache2

To see a list of all of the active units that systemd knows about, we can use the list-units command:

systemctl list-units

Service configuration Files

As must of the services in Linux Apache2 configurations files are located in the usual place: /etc/.
Specifically, the main configuration file for Apache is here:
```
/etc/apache2/apache2.conf
```
You can open it using less, but you could also use vim to explore or edit it.
```
less /etc/apache2/apache2.conf
```
Inside that file, you will found this line:
```
IncludeOptional conf-enabled/*.conf
```
That tells Apache to also load all .conf files inside the conf-enabled/ folder when it starts.
So it’s like modular config — instead of editing a single big file, you can drop in specific .conf files.
This pattern (many small config files + include directives) seems pretty common in Linux tools.
Another important configuration files in Apache2 includes

/etc/apache2/sites-available/
/etc/apache2/sites-enabled/

/etc/apache2/sites-available/: this directory contains configuration files for all available virtual hosts, that are available but not enables
/etc/apache2/sites-enabled/: - This contains symbolic links (symlinks) to the .conf files in sites-available/. If a site is linked here, it is active.

This lesson isn’t about setting up Apache2 web server or deploying a web page, so I didn’t dive into the details, only a very basic guide here

Service logs

Services saves their logs in var/logs, as expected, Apache keeps its logs under /var/log/apache2/

cd /var/log/apache2
ls -l

I checked the access.log file — I could actually see the request I made when I visited the test page in the browser.

less access.log

192.168.64.1 - - [27/May/2025:21:55:55 -0600] "GET / HTTP/1.1" 200 3459 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
192.168.64.1 - - [27/May/2025:22:17:44 -0600] "GET /sample HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
192.168.64.1 - - [28/May/2025:08:27:29 -0600] "GET / HTTP/1.1" 200 689 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"

I also looked at error.log — luckily, it was empty (which is a good sign 😅).

Appendix: Apache2 very basic setup

In Apache2, the default webpage files are located in /var/www/html
This is defined in the configuration file /etc/apache2/sites-enabled/000-default.conf, specifically in the parameter _DocumentRoot_.
To modify the default web page to custom simple page, you need to edit the var/www/html/index.html, using vimof course!
Delete everything on the current file and subtitute with this:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Welcome to My Apache Server</title>
  <style>
    body {
      font-family: Arial, sans-serif;
      background-color: #f3f3f3;
      text-align: center;
      padding-top: 100px;
    }
    h1 {
      color: #2c3e50;
    }
    p {
      color: #555;
    }
  </style>
</head>
<body>
  <h1>🚀 It works!</h1>
  <p>This is the new default page served by Apache.</p>
  <p>You can edit this page at <code>/var/www/html/index.html</code>.</p>
</body>
</html>

You will see this simple web page on your browser in http://<server-ip>

Key takeaways

systemd is the program responsible for managing and coordinating other programs that run in the background on a Linux system — known as services or daemons. But it goes beyond just services: it also manages devices, mount points, sockets, timers, and other essential components.
Think of it as the modern orchestrator of the system’s startup process and overall state.
Every sevice has their own configuration files and service logs that are stores in /etc and /var/logs respectively

Additional Resources

My Linux Upskill Challenge: Day 6

Carlos Leonel Ramirez — Mon, 26 May 2025 12:14:57 +0000

Introduction

This is my journal note following the Linux Upskill Challenge: Day 6.

Editing Text Files with `Vi`

Part of being a Linux system administrator is being skilled at editing text files.
nano and pico are for beginners! (noobs 🙂)…
Grown-ups usually use vi❗ — a text editor developed in the 70s by Bill Joy.
Vim is the modern version (it’s been around for 20+ years), and it’s the de facto text editor on servers. Knowing how to use it — or at least how to exit it — is a must for any sysadmin.
Vim stands for Vi IMproved.
In 2014, NeoVim appeared — a fork of Vim that is more customizable and backed by a large community of users (also, kind of a hype!).
Having said that, the words Vi and Vim are used interchangeably in this document, but the difference between each has already been clarified.

Vim 101

Check the version of `vi`installed

You normally run vicommand, however probably what you have installed is vim, to check the version run:

vi --version

You should obtain something like this:

carlos@ubuntu:~$ vi --version
VIM - Vi IMproved 9.1 (2024 Jan 02, compiled Apr 01 2025 20:12:31)
Included patches: 1-16, 647, 678, 697
Modified by team+vim@tracker.debian.org
Compiled by team+vim@tracker.debian.org
...

Normally vimis installed by default on every modern Linux distribution, in case you need to installed it you can use in Ubuntu using

sudo apt install vim

For non-Debian based Linux distribution you will need to use another packet manager.

Vi modes

There are two “modes” when working with Vim:
- “normal mode”
- “insert mode”
Sometimes, it’s very hard to know which mode you’re currently in, because there’s very little — or no — information on screen that could give you a clue.
When in doubt, just remember this:

TIP

“Press ESC twice or more to return to normal mode”

The “normal mode”, also called “command mode”, is used to enter commands.
The “insert mode” is used for writing text.

Open and exit without saving

Make a copy of an existing text file to your home, so you can edit it. Open it with Vim:

cd
pwd
cp -v /etc/services testfile
vim testfile

You will see the content of the file open in the editor. However, there is no “on-screen menu” like what you’re used to with nano.
By default, Vim opens the file in “normal mode”, so if you enter a key, it will be interpreted as a command , not as a character you want to insert.
The next key you press in “normal mode” will determine the behavior of Vim.
To be 100% sure you’re in normal mode, press ESC twice.
To exit the file without saving any changes, while in “normal mode”, type :q! and press Enter.

Believe me! This will be a vital skill when you’re taking your first steps.

Navigating in the file

You can navigate in the file using the keys: h, j, k, and l. This is the traditional method since vi.
The arrow keys may work as well; however, it’s important to get familiar with the traditional keys, because you may encounter systems where the arrow keys don’t work.
- h → moves cursor left
- j → moves cursor down
- k → moves cursor up
- l → moves cursor right
Other useful commands in “normal mode” to navigate through the file:
- G — moves to the bottom of the file
- gg — moves to the top of the file

Delete a single character or word

Navigate througt the file and press x to delete the character under the cursos.
Press X to delete the character before cursor
To delete the whole word use dw

Delete a line

To delete a single line, put the cursor in the line you want to delete an press dd in normal mode.

dd

Delete multiple lines in one stroke

I moved down a few lines in the file and pressed 3, then 3 again, then d, and d again — and 33 lines were deleted all at once 🙀
To delete multiple lines at once in “normal mode”, use:

<num-of-lines>dd

Where <num-of-lines> is the number of lines you want to delete.

Undo the last change (undo)

Fortunately, I was able to undo the deletion by entering the following command in “normal mode”. This command will undo the last change:

Finding things

To search for the word “sun”, type /sun in “normal mode” and Vim will find the first instance in the file.
Hit Enter, then press n repeatedly to go through all the occurrences.

Cut and Paste

To cut a line, place the cursor anywhere on the line and press dd (in normal mode). This deletes the entire line and stores it in Vim’s clipboard (called the “unnamed register”).
To paste , press P (uppercase). The cut line will be inserted above the current line — everything below will move down.
To cut multiple lines at once, enter <number-of-lines>dd in normal mode. For example, 5dd will delete 5 lines starting from the current one, and store them in Vim’s clipboard.
To paste all those lines, do the same as before: press P (uppercase), and all the lines will be inserted above the current line — everything else will shift downward.
Pasting with p (undercasse) also works, the difference is the text will be pasted below the current line, meaning that everything else will shift upwards.

Inserting Text

You can place the cursor anywhere in the file and press i in Normal mode. This will allow you to insert any text you want.

Finally, it’s behaving like a normal text editor!!

This puts you in “Insert Mode”, and you’ll notice an -- INSERT -- message in the status bar of Vim.

To return to Normal mode, just press ESC twice.

Copy (Yank) and Paste

There is a third mode in Vim, called “Visual Mode”, which lets you move the cursor while selecting text.
To enter Visual Mode, press v, then move the cursor to select the desired text. Press y to copy the selection to the clipboard.
Use P to paste before the cursor or p to paste after the cursor.
To yank (copy) the current line, use yy.
To yank 3 lines, use 3yy.
To yank the word under the cursor, use yaw.

“Yank” is the term in Vim for “Copy”

Saving Changes

Once you’re done and want to save your changes without exiting, you “write” the file using this command in Normal mode:
If you want to save and exit Vim:

Next Steps

There’s a built-in interactive tutorial to help you learn Vim basics, called vimtutor. To try it, just run:
It typically takes about 30 minutes to complete.
It’s recommended to do it regularly over a couple of weeks to build solid Vim skills.
Also, it’s a good idea to start using vim (or vi) every time you need to edit a file from now on.
Everything described here also works with NeoVim, so I’ll start using it and exploring it. There’s also a built-in tutorial in NeoVim called :Tutor — I’ll try it when I get the chance.
I currently use Obsidian to edit my notes, but I might explore NeoVim as an alternative note editor. Although… I’ve seen that many who go down that path never come back the same. Hopefully, I won’t regret it 🙂

Related Notes

Previous Lesson: Linux Upskill Challenge: Day 5
Next Lesson: My Linux Upskill Challenge: Day 7

External Resources

My Linux Upskill Challenge Journey: Day 1

Carlos Leonel Ramirez — Thu, 22 May 2025 19:10:33 +0000

Originally published on my Digital Garden here

Introduction

I’ve started following the Linux Upskill Challenge to sharpen my Linux knowledge and hands-on skills. It’s a series of 21 lessons designed to be completed daily, but I’ll be going through them at my own pace. I’ll share my journey and notes here as I move forward.

Day 1 - Get to know your server

URL: https://linuxupskillchallenge.org/01/
Previous Lesson: [[20250429T1854-linux-upskill-day-0|My Linux Upskill Challenge: Day 0]]

General Information

I connected to my Linux server in the cloud and ran the following commands:

lsb_release -a: Shows which Linux distribution and version is installed.
cat /etc/os-release: Another way to check the distro—just look at the contents of this file.
uname -a: Prints system information like kernel version and hardware platform.
uptime: Displays how long the server has been running since the last restart or shutdown.
cat /proc/uptime: Another way to check system uptime.
whoami: Shows the current user.
who: Lists all logged-in users.
w: Shows what logged-in users are doing.

Hardware Information

lshw: Displays detailed hardware info.
lscpu: Shows CPU information.
lscpu | grep Hypervisor: Shows which hypervisor your VM is using—my EC2 instance uses Xen.
lsblk: Lists storage devices and their partitions. This command led me to start reading about the [[20250429T1748 snap package manager]].
lspci: Lists all PCI devices. These are emulated by the Xen hypervisor, and some are quite outdated.
lsusb: Lists USB devices—my EC2 instance shows none, as expected.

Measuring Memory and CPU Usage

free -h: Displays memory usage in a human-readable format.
vmstat: Gives a snapshot of system performance (CPU, memory, I/O, etc.). Use vmstat 1 for continuous output.
top: Real-time summary of system resource usage.
htop: A more interactive, colorful version of top.

Measuring Disk Usage

df -h: Shows disk space usage in human-readable format.
du -h: Shows the size of directories and subdirectories (including hidden ones).
sudo du -h --max-depth=1 /: Useful for checking the largest folders under /.

Measuring Network Usage

ifconfig: Lists network interfaces and IPs (deprecated, but pre-installed). My EC2 instance shows two: enX0 and lo (loopback).
ip address: The modern replacement for ifconfig.
netstat -i: Displays interface statistics. It’s deprecated in Ubuntu 24.04.2 LTS and not available by default. I installed it using:

  sudo apt install net-tools -y

ifstat: Live bandwidth usage per interface. Not installed by default—installed with:

  sudo apt install ifstat

nload: A real-time visual network monitor.
sudo iftop -i enX0: Shows live connections, traffic direction, and throughput (like top, but for the network).

Extra: Modern Replacements for `netstat`

Old `netstat` Command	Modern Alternative	Purpose
`netstat -i`	`ip -s link`	Interface stats
`netstat -tuln`	`ss -tuln`	Listening ports (TCP/UDP)
`netstat -rn`	`ip route show`	Routing table
`netstat -a`	`ss -a`	All sockets
`netstat -plnt`	`ss -plnt`	Listening TCP ports + PID

My Linux Upskill Challenge Journey: Day 0

Carlos Leonel Ramirez — Thu, 22 May 2025 18:52:14 +0000

This content was originally published as part of my Digital Garden that you can find here:

Introduction

Day 0 - Get Your Own Server

URL: https://linuxupskillchallenge.org/00/

I created an EC2 instance in an AWS account] I already had with this specs:
Instance type: t2.micro
- OS: Ubuntu 24.04.2 LTS
- Region: us-east-1
- SSH key: linux.pem (AWS instances don’t use passwords for authentication)

Issue: When I created the key pair, I named it linux, but when it was downloaded to my computer, the file was called "EC2 Instance Key.pem".

Solution: I had to rename the key file from "EC2 Instance Key.pem" to linux.pem using:

mv "EC2 Instance Key.pem" linux.pem

Everything worked fine. Actually, the server doesn’t care about the file name—it only cares about the contents.

I connected to the EC2 instance using the ubuntu user and the public DNS. But first, I had to set the correct permissions on the key file:

chmod 400 linux.pem

Then I used the following command to connect via SSH:

ssh -i linux.pem ubuntu@<PUBLIC DNS>

After logging in, I ran both sudo apt update and sudo apt upgrade to upgrade all pre-installed packages.

[!NOTE]

The public IP and DNS of the server change every time you stop and restart the instance.

[!NOTE]

I need to remember to turn off the server when I’m not using it to avoid being charged!

I used sudo shutdown now. This stops AWS from charging me for compute time, but storage (EBS volume) and the public IP (if static) may still incur charges.

Linux Upskill Challenge: Day 5 - More or less…

Carlos Leonel Ramirez — Thu, 22 May 2025 00:22:52 +0000

Introduction

This is my journal note following the Linux Upskill Challenge: Day 5.

The more and less command
How Tabs completion works in Linux, what happe when there is ambiguity?
history command
repeat a command with !<line number> and how the command get at the begining of the queue, but the previous number get lost.
repeat a command - use of ctrl+r to search for any part of a previous command
hidde files are also called dot files because they start with a dot(.), you list them with ls -la or ls -ltra
The most common use of a “dot file” is to keep personal settings in the home directory
the use of less to look the contents of .bashrc, .bash_history
the use of nano to create a file with the summary of the last 4 lessons
Changing the bash terminal to zsh, fish and oh-my-zsh
Terminal multiplexers: screen and tmux
some simple examples of how to customize your tmux

📄 `more` and `less` commands

more is a command that lets you view text files one page at a time. You press space to go to the next page. When you get to the end of the file, you cannot go back.
less is similar but more powerful — you can scroll up and down with the arrow keys and search inside the file with /.
Example of use:

  more / etc/services
  less /etc/services

I experimented with these two commands that allow you to view the content of text files. Certainly, they work in different ways. I think the winner is less, which is more flexible, but I think there should be situations where more does the work.

🧠 Tab Completion in Linux

Tab completion lets you press Tab to auto-complete commands, file names, or paths.
This is a feature provided by the shell: bash , zsh , and fish all supports Tab completion.
If there’s ambiguity (multiple matches), pressing Tab twice shows a list of possibilities.
Works with commands, paths, directories, users, etc.
Saves time and avoids typing errors.

I’m not good at memorizing commands, so this is definitely very useful when you’re working in the command line.

⏳ The `history` Command

The history command shows a list of previously run commands with line numbers.

history

history is a built-in shell command.

this only works well in bash shell

Here’s a clever trick to navigate the history output:

history | less

This uses a pipe (|) to pass the output of history as input to the less command.

It’s a great example of the UNIX philosophy: “using small tools that work together by chaining them”.

🔁 Repeating Commands

You can repeat a command from history using !<line-number>, for example:

!102

When you re-run a command with !number, it moves to the end of the history queue with a new number, and the original number is overwritten.

You can also rerun the last command with:

!!

Let said you submit a command that requieres to sudo but you forgot, instead of submit the command again preceding sudo you can use sudo !!, like this example:

less /etc/shadow
/etc/shadow: Permission denied
sudo !!
sudo less /etc/shadow

🔍 Search Command History with `Ctrl + r`

Press Ctrl + r to start a reverse search through your history.
Start typing part of a command, and it will autocomplete the most recent match.
Press Ctrl + r again to go further back, or Enter to run it.

🕵️ Hidden Files (Dot Files)

Hidden files in Linux start with a dot (.), so they’re often called dot files.
You list them with:

ls -la

ls -ltra

Common dot files include .bashrc, .bash_profile, .bash_history,.ssh/, etc.
These files store personal configurations in your home directory.

📂 Exploring Dot Files

I used less to read the contents of dot files:

less ~/.bashrc
less ~/.bash_history

✏️ Editing with `nano`

nano is one of the most widely used text editors in Linux because of its ease of use
I used nano to create a new file with a summary of the first 4 lessons.
Example:

nano lessons_summary.txt

I was already familiar with the basic functions of nano, but I will have to delve into more advanced functions later.

🐚 Switching Shells: `bash`, `zsh`, `fish`

Linux supports multiple shell programs beyond just bash.
I tried out:
I wrote this as a separate note to describe the process to install and change the shell

🧩 Terminal Multiplexers: `screen` and `tmux`

A terminal multiplexer is a command-line tool that lets you run and manage multiple terminal sessions within a single terminal window or SSH connection, and keep them running even if you disconnect.

`screen`

screen is a tool that let you have multiple shell sessions on a server, and let them “in the background”, while you work in another thing.
You can even logout for your server, and get back when you left on a session.

I confess it was hard to get it the first time, but after watching a YouTube video and asking ChatGPT, I kind of got it. I’ll put the references at the end of the note.

`tmux`

20250523T0650-tmux-basic-guide

What a Shell is?

Carlos Leonel Ramirez — Fri, 16 May 2025 23:08:17 +0000

So what actually the Shell is?

The Shell is the “program” that runs on the server side that provides the command-line interface between the user and the operating system.

It’s the program that reads, interprets and run the commands that you type when you connect to a server.

The shell interprets the commands you enter and some of them are “executed” by the shell itself, and others are passed to the operating system to be executed by a program.

Different shells exist — some are mostly historical, while others are still widely used today. The most common ones are bash and zsh. zsh is especially popular among power users and developers 😉

On Linux, every user can choose which shell they want to use as their default login shell.

🧠 Why are there different shells?

Because over time, developers built new shells with more features , better scripting, customization, performance, or user experience — just like how web browsers or text editors evolved.

Each shell aims to:

Improve on limitations of older shells
Add scripting capabilities
Provide better interactivity (autocomplete, colors, plugins, etc.)
Cater to specific use cases (like scripting vs. interactive use)

Related notes

My Linux Upskill Challenge Journal: Day 4 - Installing software, exploring the file structure

Carlos Leonel Ramirez — Thu, 08 May 2025 13:14:29 +0000

Introduction

This is the Day 4 Journal on my Linux Upskill Challenge , yes, this is the lesson when you get in deep with the Linux File System, I also learned about how to install packages in Ubuntu Linux with APT.

Introduction
Installing packages in Ubuntu Linux
Linux File System
Questions I asked myself 🤔
Related Notes

Installing packages in Ubuntu Linux

Think of packages like programs or applications (apps) that you install on your phone.
Like the “App Store” or the “Market” on your phone, in Linux we call them Package Managers.
One of the most popular (if not the most used) package managers in Ubuntu (and other Linux distributions based on Debian) is apt.
APT stands for “Advanced Package Tool” and is used to install, update, and manage software packages.

If you know a keyword or part of the description of a package, you can search for it using the apt search command. For example:

apt search "midnight commander"

This will display a list of packages matching the search term along with a brief description of each:

mc/noble-updates,now 3:4.8.30-1ubuntu0.1 arm64 [installed]
  Midnight Commander - a powerful file manager

Here we can see mc is the package name for the Midnight Commander package (application).
To install the package with apt you need to use sudo, unless you’re already logged in as root.

sudo apt install mc

Package managers like apt make it easy to handle dependencies and ensure your system stays up-to-date.
There are other package managers available for Debian-based Linux distributions.
For Red Hat-based Linux distributions, the equivalent of apt is yum. (but that’s a completely different story! 🙂)

Now that we’ve installed Midnight Commander, we can use its retro interface to easily navigate the Linux file system.

The Linux File System

The Linux operating system has a standard file system structure. At first, it might seem a bit intimidating—especially if you’re only familiar with Windows, where you have the C: drive, D: drive, and various folders within each. With Linux, it’s a totally different beast.
The Filesystem Hierarchy Standard (FHS) defines the structure of file systems on Linux and other UNIX-like operating systems. However, Linux file systems also contain some directories that aren’t yet defined by the standard.
If you want to read the official manual of the file system hierarchy, type man hier

`/` ⇒ (La Raiz 🫚) The Root Directory

Everything on your Linux system is located under the / directory, also called the root directory. (Don’t confuse it with the /root directory.)
In Linux you don’t have drive letters like C: or D:. Everything is under /, even if you have different physical drives and partitions— all of them will be under /.

`/boot` ⇒ 🥾 Boot files

Contains all the files needed to boot the system, including the currently installed Linux kernels and their supporting files.
The GRUB bootloader’s files are stored here as well.
It is better not to mess with this directory!

`/etc` ⇒ ⚙️ Configuration Files

Key configuration files are stored here, and in subdirectories inside.
Most of the files here are simple text files.
Some interesting files under /etc:
- /etc/passwd: contains basic information about each user account (like username, UID, default shell, etc.). Passwords are stored in another file.
- /etc/ssh/sshd_config: this is the configuration file for the SSH daemon (sshd), which acts as the server for the SSH connection. (The client is on your computer! 💻)

`/home`⇒ 🏠 User Home Folders

Each user in the system will have a folder inside /home (for example /home/carlos, /home/ubuntu).
Inside each folder we have user data files, user-specific configuration files, and folders. Many of them are hidden (use ls -la to list them).
Each user can only write in their own home folder.
Example files and folders found in a home folder: .bashrc, .profile, .ssh/, .config

`/root`⇒ ⛪ The root home directory

Instead of being inside /home, the root user has their own home directory in /root.

`/bin` ⇒ Essential binaries 🧱

The /bin directory contains all the essential system binaries that Linux needs to function — even when it boots into a special recovery state called single-user mode (you can think of it like Safe Mode in Windows).
It contains important core command-line tools that must be available even if no other filesystems are mounted yet — such as ls, cp, mv, and the bash shell.
It traditionally has two sibling directories: /sbin (for essential system binaries for administrators) and /usr/bin (for general user binaries that are not critical for boot).

`/sbin`⇒ System administration binaries 💾

The /sbin directory contains essential system administration binaries used for system booting, repairing, or managing services — like fsck, reboot, and ifconfig.
These tools are generally intended for the root user or administrators , and may not be in a regular user’s $PATH.

`/usr` ⇒ 🧰 user-space programs and tools

It contains applications and files used by users, as opposed to the system itself.
These files and folders are meant to be read-only for regular users, unless you’re installing something manually into /usr/local.
These files are installed and managed by the package manager (apt, dnf, yum, etc.).
In some distros (especially immutable or container-focused ones like Fedora Silverblue, Alpine, or embedded systems), /usr is even mounted read-only at the filesystem level to improve security and stability.
/usr/bin, /usr/lib, /usr/share, and /usr/local are examples of directories inside /usr.

`/usr/bin` ⇒ 🛠️ main executables for users and apps

The /usr/bin directory contains most user-level commands and applications that are not essential for booting or single-user mode.
It’s often much larger than /bin and includes tools like git, nano, python, gcc, etc.

NOTE

⚠️ Modern Linux systems often merge /bin and /usr/bin using symbolic links. So the physical separation may no longer exist — but conceptually, this is still true.

`/usr/lib` ⇒ 📚 shared libraries for installed programs

Contains the libraries for the non-essential user-level binaries located in /usr/bin.

`/usr/local` ⇒ 🧪 custom software installed manually

Locally compiled programs not managed by the package manager.

`/var` ⇒ 📝 logs and variables

/var stands for “variable” — it contains files that change frequently , like logs and temporary data.
It is the writable counterpart to the /usr directory, which must be read-only in normal operation.
It stores system logs , like authentication attempts and errors, usually inside /var/log.
It also holds spools and queues — like for print jobs , mail , or cron jobs.
If a system is acting weird or you’re running out of disk space, /var is often the first place to check.

`/var/log` ⇒ 📂 system and service logs

This is the folder where Linux keeps log files from the system and various services.
Most of the files here are simple text files.
Some interesting files under /var/log are:
- /var/log/auth.log: Captures all authentication events — like login attempts, sudo usage, and SSH access.
- /var/log/syslog: General system activity log , useful for debugging services and applications.
- /var/log/kern.log: Messages from the Linux kernel , helpful when troubleshooting hardware or low-level issues.
- /var/log/dpkg.log: Logs of all package installations and updates (on Debian/Ubuntu systems).
- /var/log/boot.log: Records messages during the system boot process , helpful for startup issues.

`/tmp` ⇒ 🧊 temporary files for programs

/tmp is used to store temporary files created by programs, scripts, or the system itself.
The data here is not meant to be permanent — it’s usually deleted on reboot or after a certain time.
Applications use it for things like installers, locks, or temp caches while they run.
You can manually delete files here to free up space, but be careful not to remove in-use files.

`/dev` ⇒ 🔌 devices as files

/dev contains device files that represent your hardware (like disks, USBs, and terminals).
Linux treats devices like files, so you can interact with them via commands (e.g., /dev/sda, /dev/null).
It includes both physical devices and virtual ones (like /dev/random, /dev/tty).
Device files are managed by the udev system and updated automatically as devices are added or removed.

`/proc` ⇒ 🧠 system and process info

/proc is a virtual filesystem that shows real-time information about running processes and the kernel. Similarly to /dev, it doesn’t contain regular files but virtual representations of system internals.
Each process has a folder like /proc/1234 containing its memory, open files, and status.
It includes files like /proc/cpuinfo, /proc/meminfo, and /proc/uptime — great for monitoring.
These files aren’t stored on disk — they’re generated live by the kernel when you access them.

`/sys` ⇒ 🛠️ kernel interface to hardware

/sys is another virtual filesystem , used to expose and control kernel data structures.
It provides detailed info about hardware devices, drivers, and kernel modules.
It’s commonly used by tools like udevadm, systemd, or udev to detect and manage hardware.
You can even tweak some kernel parameters from here (with caution), usually under /sys/class or /sys/block.

`/lib` ⇒ 📚 Essential common libraries

This folder contains libraries needed by the binaries found in /bin and /sbin.
Linux libraries are shared collections of precompiled code that programs can use to perform common tasks.

`/media` & `/mnt` ⇒ 💽 mount points for external and manual storage

Both /media and /mnt are used as mount points — places where external or additional filesystems are attached to the main system.
/media is typically used by the desktop environment or automount system to mount USB drives, SD cards, and external disks automatically (e.g. /media/carlos/USB).
/mnt is usually reserved for manual or temporary mounts done by system administrators (e.g. mounting a backup disk or ISO).
You can mount a filesystem to either, but by convention: automated → /media , manual → /mnt.

Questions I asked myself 🤔

Related Notes

My Linux Upskill Challenge Jounal: Day 3

Carlos Leonel Ramirez — Sun, 04 May 2025 04:16:27 +0000

Introduction

I’ve started following the Linux Upskill Challenge to sharpen my Linux knowledge and hands-on skills. This is the third in a series of 21 lessons designed to be completed on a daily basis.

In this lesson, I learned about the types of users that exist in a Linux system, along with their scope and limitations. I also explored the proper way to handle administrative tasks that require elevated privileges—how to temporarily become root in order to perform sensitive actions while minimizing the risk of making a mistake that could break your server.

Day 3 - Power trip!

URL: https://linuxupskillchallenge.org/03/
Previous Lesson: My Linux Upskill Challenge: Day 2

🚪 Introduction

root is the power user on a Linux System, it’s the “super user” account that is all powerful. That also means that a typo in a command being root could mess up your server!
As a Best Practice you shouldn’t use root user, instead in a production server, instead use a specific user and run root-only commands via the sudo command.
sudo is a command that allows a user to execute commands with elevated privileges — typically as root. What a user is allowed to run with sudo is defined in the sudoers configuration.

Lesson’s tasks

Change the password or your sudo user
Change the hostname
Change the timezone

👨‍👦‍👦 Linux type of users

In a Linux system you can do two kind of changes
- Global changes: affects all users, programs/environments shared with any user.
- Local changes: affects only one user, programs/environments for a particular user.

In Linux there are three type of user:
- root - the all-mighty powerful superuser that can execute any command and can do global changes and local changes for any user as well.
- sudoers - those are regular users (or groups) that are allowed to use sudo to run commands with elevated privileges. It’s common (and best practice) to grant at least one sudoer with the same power as root, while others with may be restricted on only certain commands, you specify this in the sudoers configuration file.
- regular user - only can do local changes, and not allowed to use sudo

🚀 Sudo Access and User Creation on EC2

On an AWS EC2 instance, the root user is disabled by default. The default user is ubuntu, who already has sudo privileges — it’s already a sudoer.
I confirmed this with the following commands:

whoami
# ubuntu
groups ubuntu
# ubuntu : ubuntu adm cdrom sudo dip lxd
sudo whoami
# root

You can enable SSH login as the root user by following this guide, but I didn’t try it — it seemed risky and unnecessary for my purposes.
Instead, for practice, I created a new user named carlos and gave him the same privileges as ubuntu using the following commands:

sudo adduser carlos
sudo usermod -aG sudo carlos

There’s another way to grant elevated privileges to a user: by modifying the /etc/sudoers file. To safely edit this special file, you should always use the visudo command. For now, I chose the simpler group-based method instead.
You can change the password for any given user with passwd command

passwd carlos
Changing password for carlos.
Current password: 
New password: 
Retype new password: 
passwd: password updated successfully

🔐 SSH Access with Shared Key

When I added the new user, it asked me to set a password. However, I wanted carlos to log in using the same SSH key as the ubuntu user, and also make sure password-based authentication remained disabled.
I used the following steps:

# Create .ssh directory for carlos
sudo mkdir -p /home/carlos/.ssh

# Copy authorized_keys from ubuntu
sudo cp /home/ubuntu/.ssh/authorized_keys /home/carlos/.ssh/

# Set correct ownership and permissions
sudo chown -R carlos:carlos /home/carlos/.ssh
sudo chmod 700 /home/carlos/.ssh
sudo chmod 600 /home/carlos/.ssh/authorized_keys

I then started a new SSH session as carlos , using the same linux.pem key file.
I also tested login using a password instead of the SSH key, and it was rejected. As it turns out, password-based SSH authentication is disabled by default on this EC2 AMI, so no extra configuration was needed.

🧪 Password Prompt on `sudo`

One difference I noticed: when running sudo as carlos, it prompted for the user password, unlike ubuntu, which doesn’t require it. Here’s the behavior:

carlos@ip-172-31-92-220:~$ whoami
carlos
carlos@ip-172-31-92-220:~$ sudo whoami
[sudo] password for carlos: 
root

This is because the default sudo configuration in EC2 lets ubuntu run sudo without a password, but any new user added to the sudo group will be required to authenticate with their password (unless you explicitly configure otherwise in /etc/sudoers).
To make carlos run sudo without a password you need to create the file /etc/sudoers.d/carlos using visudo:

sudo visudo -f /etc/sudoers.d/carlos

and add the following line:

carlos ALL=(ALL) NOPASSWD:ALL

Actually AWS pre-configure this for the ubuntu user in the file /etc/sudoers.d/90-cloud-init-users, as I checked here:

sudo cat /etc/sudoers.d/90-cloud-init-users
# Created by cloud-init v. 24.4.1-0ubuntu0~24.04.1 on Fri, 25 Apr 2025 00:08:00 +0000

# User rules for ubuntu
ubuntu ALL=(ALL) NOPASSWD:ALL

Testing the power of `sudo`

If you try to use cat /etc/shadow to view the contents of the file, access will be denied, but if you use sudo cat /etc/shadow it will work. 🤓 This file contains the hashed password for all system users, so it’s a intentionally restricted or non-authorized users.
Also If I tried the reboot command will be rejected, but with sudo reboot it works and the server will fully restarted. In confirmed with uptime when the server was online again.
With the last command you can see the login history, you can filter by username (e.g. last ubuntu, last carlos or `last root)
- As expected, on my EC2 instance there wasn’t entries for root

last root wtmp begins Fri Apr 25 00:07:50 2025

I checked the failed login attempts with the command sudo lastb, and I found that an IP from China had tried to log in to my server using the a user user several times on May 2nd. 😱
Apparently, this is kind of normal for internet-facing servers, and there’s nothing to worry about at this time. However, implementing fail2ban could be a good idea.

You can use the command sudo -i to fully become the root user. That means from now on, you won’t need to prefix commands with sudo for any high-privilege tasks. This is handy when you have a series of commands to run as “root.” You’ll also notice that the prompt changes. I recommend doing this with caution.
To get back to your normal “sudoer” account you need to type exit or logout

carlos@ip-172-31-92-220:~$ whoami carlos carlos@ip-172-31-92-220:~$ sudo -i root@ip-172-31-92-220:~# whoami root root@ip-172-31-92-220:~# logout carlos@ip-172-31-92-220:~$ whoami carlos carlos@ip-172-31-92-220:~$

With sudo journalctl -e /usr/bin/sudo you can see the last times when sudo was used including the user which used and with which command.

👷 Administrative Tasks

This are some examples of simple administrative tasks that a sysadmin regualar do using sudo:

Change the hostname

One of the must basic task for you’ll need sudo priviledges is to rename your server, that means change the hostname.

Probably the current hostname of the server is what you see in the prompt after “username@”, however if you want to double check, there are several ways to do it on linux: you can issue any of this commands: hostname , uname-h, or check the content of this file: cat /etc/hostname.

Also, if you need to change it, you can use any of this options:

Edit these two files: /etc/hostname and /etc/hosts , and then reboot the server
(Recommended) Use the command hostnamectl withouth rebooting the server, like this:

sudo hostnamectl set-hostname myec2ubuntu

To observe the change in the prompt you should open a new session using the command bash or just logout and login again.

carlos@ip-172-31-92-220:~$ sudo hostnamectl set-hostname myec2ubuntu carlos@ip-172-31-92-220:~$ bash carlos@myec2ubuntu:~$

I stopped and re-started the EC2 instance just to be sure the new hostname preservers after the server restart.

NOTE

I decided to deploy a local VM on my computer to not depend on starting an EC2 instance in AWS every time I want to lab, this saves me time (and money!)

So I installed UTM on my Mac computer and used Ubuntu Server for ARM (24.04.2 LTS) ISO image to launch my Linux VM, and I destroyed (Terminate) the EC2 in AWS.

I may do a Installation Guide someday

Change the Timezone

Another regular task when you are in charge or server administration is to setup the correct timezone (this could be the timezone of the region the server is actually located, or a timezone the company agreed). The default for any Linux server is UTM. (that is same as GMT).

To check the current settings you use:

timedatectl

You can check the available timezones with:

timedatectl list-timezones

After decide which one to use, I change it using this command

sudo timedatectl set-timezone Americas/Guatemala

Then I confirmed the change, again with:

`
timedatectl

           Local time: Thu 2025-05-08 12:51:30 CST
       Universal time: Thu 2025-05-08 18:51:30 UTC
             RTC time: Thu 2025-05-08 18:51:30
            Time zone: America/Guatemala (CST, -0600)

System clock synchronized: no
NTP service: active
RTC in local TZ: no
`

Selecting the correct timezone for all your servers take importance when you need configure scheduled tasks that you need to run at certain time, it also allows you to have consistency in the timestamps of your log files (those under /var/log).

Final Question?

What’s the difference between `sudo -i` and `sudo -s`?

sudo -i and sudo -s are two commands that allow you to “become root” and run elevated-privilege commands without needing to prefix each one with sudo. However, they have some key differences:
sudo -i launches a root shell—it’s like starting a new shell session as if you had logged in directly as the root user. It also loads the root user’s environment and places you in the /root directory (cd /root). If you type echo $HOME, it will point to /root. The -i stands for “simulate initial login”.
sudo -s also launches a root shell, but it doesn’t load the root environment and keeps you in your current working directory. The -s stands for “shell”, and it’s less powerful than -i.

Conclusion

Always double check before pressing Enter when you’re acting as root on a server.
Always try to use for daily operations a “normal” account and add to sudoers group so need to use sudo for elevated priviledge commands.
For critical changes on production systems, take extra precaution actions like using a test environment, check for syntax errors and typos, and monitor the log files.

Additional Resources

Related Notes:

My Linux Upskill Challenge Journey: Day 2

Carlos Leonel Ramirez — Fri, 02 May 2025 02:09:07 +0000

Introduction

Day 2 - Basic navigation

URL: https://linuxupskillchallenge.org/02/
Previous Lesson: My Linux Upskill Challenge: Day 1

RTFM

In this lesson, I learned a new acronym: RTFM – “Read the F***ing Manual.” 😆
When you’re learning and using Linux (or anything else) and have questions, of course, you’re always free to Google it or ask ChatGPT.
However, the best system administrators are those who first RTFM.

This is something we’re starting to forget nowadays!

Linux systems offer several ways to access documentation. But if—after searching—you still need help, you can always ask a well-written question in forums, Reddit, Discord, or other communities.

I think this is even more relevant today, especially when writing good prompts in the “GPT era.”

Looking for Documentation

The man command is a great place to start—most installed applications have their own manual.
For instance, you can find the manual for these commands:
That said, man output can be overwhelming for some commands or too minimal for others. That’s where tldr comes in—it provides simplified, community-written man pages for common Linux (and other OS) commands.

tldr is another tool for viewing documentation. I installed it using sudo apt install tldr, but it didn’t work right away on my EC2 instance.
I got the following error:

tldr: /home/ubuntu/.local/share/tldr: createDirectory: does not exist (No such file or directory)

I fixed it with these two commands:

mkdir -p ~/.local/share/tldr
tldr --update

The second command pulls the latest pages from the official GitHub repo (make sure your server has internet access!).
I tried tldr with the same commands as before, and yes—it showed me much more simplified info.

I also learned about the apropos command, which is equivalent to man -k.
Both are useful when you kind of know what a command does and want to search for keywords in the manual.
For example, if you search for the phrase “remove file” using apropos "remove file", you’ll get results like this:

ubuntu@ip-172-31-92-220:~$ apropos "remove file"
git-rm (1) - Remove files from the working tree and from the index
rm (1) - remove files or directories
ubuntu@ip-172-31-92-220:~$ man -k "remove file"
git-rm (1) - Remove files from the working tree and from the index
rm (1) - remove files or directories

Some commands—especially shell built-ins—don’t have man pages.
For those, you can use the help command instead.
Example: use help export instead of man export.
I found exceptions like echo, which works with both man echo and help echo.
The best way to check if a command is a shell built-in is to use the type command.

Lastly, there’s the info command. It gives more detailed documentation, sometimes written in a tutorial style and with hypertext navigation.

Navigate the File Structure

I discovered a command that gives you documentation about the Linux file system: man hier.
/ is the top-level directory (called root ) for all other folders.
🧭 To find out where you are in the file system, use pwd—this is like your GPS in Linux. 🛰
By default, you’ll start in the /home/<user> directory, unless you’re logged in as root, in which case you’ll be in /root.
You can move between directories using cd:
You can use either relative or absolute paths to move around:
Just running cd returns you to your home directory, as does cd ~.
You can also use ~ as a shortcut to move into folders inside your home directory from anywhere.

ubuntu@ip-172-31-92-220:/var/log$ cd ~/data/example/
ubuntu@ip-172-31-92-220:~/data/example$

Listing Files in a Folder

I used ls with different options (“switches”) to list files.

For example: ls, ls -l -L, and ls -l -t -r -a (or just ls -ltra).
Files or folders that start with a . are hidden. Use ls -a to see them.
You can combine switches and provide a folder path:

e.g., ls -ltra /var/log
Entries that start with d are directories.
Some terminals show these in a different color—if not, try --color=auto.

ubuntu@ip-172-31-92-220:~/data/example$ ls -ltra /var/log
...

Basic Directory Manipulation

I created a new folder with mkdir test, then moved into it with cd test.
You can repeat this to build nested folder structures.

mkdir test
cd test

To move a folder into another directory, I used mv:
Created a folder test2, then moved example from test to test2.

mv test/example test2

To remove an empty directory, use rmdir.
To remove a non-empty one, use rm -r.

Basic File Manipulation

To create a new (empty) file: touch newfile.txt
To move it: mv newfile.txt test2
To delete it: rm

touch newfile.txt
mv newfile.txt test2
rm test2/newfile.txt

A Bit More Advanced Directory Navigation (Stack-Based)

I learned about pushd and popd, which let you move between folders using a stack (LIFO order).
It’s different from cd ..—with pushd you can hop to /etc, then /var/log, and then jump back in reverse order using popd.
Use dirs to see the current directory stack.

pushd /etc
pushd /var/log
dirs
popd
popd

If you run pushd without arguments, it swaps your current and previous directories—similar to cd -, but it remembers your path history.

So these are my notes for the Day 2 – Basic Navigation of the Linux Upskill Challenge.

DEV Community: Carlos Leonel Ramirez

My Linux Upskill Challenge: Day 9

Checking Open Ports

Linux firewall

🔎 iptables output explained

🔹 Chain: INPUT

🔹 Chain: FORWARD

🔹 Chain: OUTPUT

Output Summary

Uncomplicated Firewall (UFW)

Changing default ssh port

Conclusions

My Linux Upskill Challenge: Day 8

Introduction

Sample Log File Setup

Core Text Analysis Tools

cat - Display File Contents

less - Interactive File Viewer

tail - View File Endings

head - View File Beginnings

Pattern Matching and Filtering

grep - Search Text Patterns

The Power of Pipes (|)

Basic Pipe Examples

Data Extraction and Manipulation

cut - Extract Columns/Fields

sort - Arrange Lines

uniq - Remove Duplicates

Advanced Text Processing

awk - Pattern Scanning and Data Extraction

sed - Stream Editor

Output Redirection

Save Output to Files (>)

Practical Log Analysis One-Liners

🔍 Top Visitor IPs

📂 Request Methods Analysis

🧑‍💻 User-Agent Analysis

📊 HTTP Status Code Breakdown

🔐 Find Failed Access Attempts

🌐 Filter by Browser Type

📄 Most Requested Paths

🔍 Find 404 Error Paths

⏰ Traffic by Hour

Advanced Analysis Examples

Most Active IPs with Request Count

Browsers Causing Most Server Errors

Traffic Analysis by Time Period

Large Response Analysis

Key Takeaways

External Resources

Related Notes

My Linux Upskill Challenge: Day 7

Introduction

Before we Begin

Installing Apache2 on Ubuntu

How to verify Apache is running

Understanding Services in Linux

What is a service in Linux?

How are services managed?

Process, Daemons, Services, and Units

Process

Daemon

Service

Unit

What is systemd ?

The command systemctl

Start and Stop services

Restart and Reload services

Check status

Enabling and Disabling Services

Service configuration Files

Service logs

Appendix: Apache2 very basic setup

Key takeaways

Additional Resources

My Linux Upskill Challenge: Day 6

Introduction

Editing Text Files with Vi

Vim 101

Check the version of viinstalled

🔹 Chain: `INPUT`

🔹 Chain: `FORWARD`

🔹 Chain: `OUTPUT`

`cat` - Display File Contents

`less` - Interactive File Viewer

`tail` - View File Endings

`head` - View File Beginnings

`grep` - Search Text Patterns

The Power of Pipes (`|`)

`cut` - Extract Columns/Fields

`sort` - Arrange Lines

`uniq` - Remove Duplicates

`awk` - Pattern Scanning and Data Extraction

`sed` - Stream Editor

Save Output to Files (`>`)

The command `systemctl`

Editing Text Files with `Vi`

Check the version of `vi`installed

Extra: Modern Replacements for `netstat`

📄 `more` and `less` commands

⏳ The `history` Command

🔍 Search Command History with `Ctrl + r`

✏️ Editing with `nano`

🐚 Switching Shells: `bash`, `zsh`, `fish`

🧩 Terminal Multiplexers: `screen` and `tmux`

`screen`

`tmux`

`/` ⇒ (La Raiz 🫚) The Root Directory

`/boot` ⇒ 🥾 Boot files

`/etc` ⇒ ⚙️ Configuration Files

`/home`⇒ 🏠 User Home Folders

`/root`⇒ ⛪ The root home directory

`/bin` ⇒ Essential binaries 🧱

`/sbin`⇒ System administration binaries 💾

`/usr` ⇒ 🧰 user-space programs and tools

`/usr/bin` ⇒ 🛠️ main executables for users and apps

`/usr/lib` ⇒ 📚 shared libraries for installed programs

`/usr/local` ⇒ 🧪 custom software installed manually

`/var` ⇒ 📝 logs and variables

`/var/log` ⇒ 📂 system and service logs

`/tmp` ⇒ 🧊 temporary files for programs

`/dev` ⇒ 🔌 devices as files

`/proc` ⇒ 🧠 system and process info

`/sys` ⇒ 🛠️ kernel interface to hardware

`/lib` ⇒ 📚 Essential common libraries

`/media` & `/mnt` ⇒ 💽 mount points for external and manual storage