Short task: find the changed configuration file
Among five configuration files you find the one changed overnight, work out what changed and when, keep the evidence with its digest, restore the file from the backup, catch a hidden file the attacker left behind and write down your finding. This time you choose the commands.
Level 101 · 40 min
07:30 in the morning. The night shift’s monitoring system reported that something changed in /etc/northwind, but not what. The nightly backups are in /var/backups/northwind.
This is a task: you know all the commands from the earlier lessons. Apart from the first step I give no commands; read the goal and find your way. The changed file, the change and the time are different in every lab; you can’t take the answer from someone else.
The first rule in a real incident: record the evidence first, then fix. So don’t restore the file before you have read the difference and kept the evidence.
What you will do in this lesson
- Look around
- Which file differs?
- What changed?
- When?
- Keep the evidence
- Fix it
- Write down the finding
- Short quiz
Skills you will earn
- Sorting files by modification time (ls -lt)
- Comparing two directories (diff -rq)
- Reading the difference between two files (diff)
- Reading owner, group and mode with stat
- Keeping evidence with its time and permissions (cp -p)
- Verifying file integrity with digests (sha256sum -c)
- Restoring a file from backup and verifying it
- Writing a short, precise finding
← Reading and comparing content: cat, less and diff · Linux quick start · File permissions: read, write, execute and chmod →
Start for free