helpful-commands.sh
· 816 B · Bash
Raw
sudo mkdir /mnt/sys
sudo mount -o ro /dev/sdXN /mnt/sys # find the right partition with lsblk first
sudo smartctl -a /dev/sdX # look for reallocated sectors, pending sectors, offline uncorrectable
sudo fsck -n /dev/sdXN # dry-run check, don't fix yet
chroot /mnt/sys /bin/bash # after binding /dev /proc /sys in
cat /etc/passwd # any new/unexpected user accounts?
cat /etc/shadow # password hash changed on admin account?
last -f /var/log/wtmp # login history, any logins melo doesn't recognize?
systemctl list-units --state=enabled | less # anything unfamiliar enabled?
crontab -l -u root # rogue cron jobs?
ls -la /etc/systemd/system/ # anything dropped in that shouldn't be there?
| 1 | sudo mkdir /mnt/sys |
| 2 | sudo mount -o ro /dev/sdXN /mnt/sys # find the right partition with lsblk first |
| 3 | sudo smartctl -a /dev/sdX # look for reallocated sectors, pending sectors, offline uncorrectable |
| 4 | sudo fsck -n /dev/sdXN # dry-run check, don't fix yet |
| 5 | |
| 6 | chroot /mnt/sys /bin/bash # after binding /dev /proc /sys in |
| 7 | cat /etc/passwd # any new/unexpected user accounts? |
| 8 | cat /etc/shadow # password hash changed on admin account? |
| 9 | last -f /var/log/wtmp # login history, any logins melo doesn't recognize? |
| 10 | systemctl list-units --state=enabled | less # anything unfamiliar enabled? |
| 11 | crontab -l -u root # rogue cron jobs? |
| 12 | ls -la /etc/systemd/system/ # anything dropped in that shouldn't be there? |