A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A Linux audit script should answer concrete questions: who ran it, what identity data is present, which sensitive paths have unusual modes, which services are active, and what sockets are listening. The script becomes useful when each finding points to evidence instead of merely saying “configuration looks unsafe.”
Keep the checks read-only. A teaching audit should discover and report rather than automatically changing permissions or disabling services. Remediation is a separate workflow because the correct fix depends on application requirements and package ownership.
Captures identity and group context as evidence. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
Tool choice is situational. Start with the narrowest command that answers the question, then escalate to a heavier tool only when the first observation leaves a real gap.
Use a stable finding format so a later parser can consume it. A simple line such as `severity|check|evidence` is enough for a first version. The important part is consistency and honest severity labels: a world-writable temp directory is not automatically equivalent to a writable system binary.
Collects listening socket information where privileges allow process attribution. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Captures the set of currently running services on a systemd host. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.