191 commands · 11 cheat sheets · Linux

Identity, Access, and Security master quick reference

Browse 191 commands from 11 focused cheat sheets on page 1 of 1. Each example opens its matching detailed section.

Identity, Access, and Security · 20 commands

AppArmor Profiles and Troubleshooting Cheat Sheet

Use	Syntax	Examples
Check module availability	`aa-enabled`	View examples
Inspect loaded policy	`sudo aa-status`	View examples
Inspect one task label	`pid=$(systemctl show reportd.service -p MainPID \ --value); sudo cat "/proc/$pid/attr/current"`	View examples
Find recent denials	`sudo journalctl -k --grep='apparmor="DENIED"' \ --since='15 minutes ago'`	View examples
Query Audit records	`sudo ausearch -m AVC,USER_AVC -ts recent \| grep 'apparmor="DENIED"'`	View examples
Include base abstraction	`#include <abstractions/base>`	View examples
Include local overrides	`#include if exists <local/usr.local.bin.reportd>`	View examples
Allow recursive reads	`/srv/reporting/** r,`	View examples
Allow directory traversal	`/srv/reporting/ r,`	View examples
Limit writes to owned files	`owner /var/lib/reportd/** rwk,`	View examples
Execute without transition	`/usr/bin/logger ix,`	View examples
Allow TCP networking	`network inet stream,`	View examples
Validate without loading	`apparmor_parser -Q /etc/apparmor.d/usr.local.bin.reportd`	View examples
Expand includes	`apparmor_parser -p /etc/apparmor.d/usr.local.bin.reportd`	View examples
Replace one loaded profile	`sudo apparmor_parser -r \ /etc/apparmor.d/usr.local.bin.reportd`	View examples
Load complain mode temporarily	`sudo apparmor_parser -C -r \ /etc/apparmor.d/usr.local.bin.reportd`	View examples
Persist complain mode	`sudo aa-complain /usr/local/bin/reportd`	View examples
Restore enforce mode	`sudo aa-enforce /usr/local/bin/reportd`	View examples
Review logged behavior	`sudo aa-logprof`	View examples
Disable one profile	`sudo aa-disable /usr/local/bin/reportd`	View examples

Identity, Access, and Security · 14 commands

Linux Audit Framework and auditd Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Inspect kernel audit status	`sudo auditctl -s -i`	View examples
Inspect the audit daemon	`sudo systemctl status auditd --no-pager`	View examples
List active kernel rules	`sudo auditctl -l`	View examples
Check whether rules changed	`sudo augenrules --check`	View examples
Build the merged rules file	`sudo augenrules`	View examples
Build and load persistent rules	`sudo augenrules --load`	View examples
Audit writes and metadata changes	`-a always,exit -F arch=b64 -F path=/etc/sudoers -F \ perm=wa -k sudoers_change`	View examples
Audit a directory tree	`-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F \ perm=wa -k sudoers_change`	View examples
Audit failed file access	`-a always,exit -F arch=b64 -S openat,truncate -F \ dir=/etc/ -F success=0 -k etc_access_denied`	View examples
Search by rule key	`sudo ausearch --start today --key sudoers_change -i`	View examples
Search failed events	`sudo ausearch --start recent --success no -i`	View examples
Summarize authentication activity	`sudo aureport --auth --summary -i`	View examples
Request auditd internal state	`sudo auditctl --signal state`	View examples
Lock the audit configuration	`-e 2`	View examples

Identity, Access, and Security · 20 commands

Linux Capabilities and File Attributes Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Read process capability masks	`grep -E '^Cap(Inh\|Prm\|Eff\|Bnd\|Amb):' /proc/1234/status`	View examples
Decode a capability mask	`capsh --decode=0000000000000400`	View examples
Show current capability context	`capsh --print`	View examples
Read file capabilities	`getcap -v /usr/local/bin/ping-helper`	View examples
Scan one filesystem tree	`sudo getcap -r /usr/local 2>/dev/null`	View examples
Grant network bind capability	`sudo setcap 'cap_net_bind_service=ep' \ /usr/local/bin/webd`	View examples
Remove file capabilities	`sudo setcap -r /usr/local/bin/webd`	View examples
Verify expected capability	`getcap /usr/local/bin/webd \| grep -F 'cap_net_bind_service=ep'`	View examples
Show highest supported capability	`cat /proc/sys/kernel/cap_last_cap`	View examples
Check no-new-privileges	`grep '^NoNewPrivs:' /proc/1234/status`	View examples
Inspect unit capability policy	`systemctl show webd.service -p CapabilityBoundingSet -p \ AmbientCapabilities -p NoNewPrivileges`	View examples
Analyze unit exposure	`systemd-analyze security webd.service`	View examples
List file attributes	`lsattr -d /etc/important.conf`	View examples
Set immutable	`sudo chattr +i /etc/important.conf`	View examples
Clear immutable	`sudo chattr -i /etc/important.conf`	View examples
Set append-only	`sudo chattr +a /var/log/example.log`	View examples
List extended attributes	`getfattr --dump --absolute-names /usr/local/bin/webd`	View examples
Read raw capability xattr	`getfattr --name=security.capability --hex \ /usr/local/bin/webd`	View examples
Copy while preserving xattrs	`cp --archive --preserve=xattr /usr/local/bin/webd \ /srv/stage/webd`	View examples
Archive with xattrs	`tar --xattrs --acls -cpf webd-backup.tar \ /usr/local/bin/webd`	View examples

Identity, Access, and Security · 20 commands

Linux PAM Authentication Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
List PAM service files	`find /etc/pam.d -maxdepth 1 -type f -print \| sort`	View examples
Read PAM overview	`man 8 pam`	View examples
Read configuration syntax	`man 5 pam.d`	View examples
Find auth rules	`grep -RnsE '^[[:space:]]*auth[[:space:]]' /etc/pam.d`	View examples
Find account rules	`grep -RnsE '^[[:space:]]*account[[:space:]]' /etc/pam.d`	View examples
Find password rules	`grep -RnsE '^[[:space:]]*password[[:space:]]' /etc/pam.d`	View examples
Find session rules	`grep -RnsE '^[[:space:]]*session[[:space:]]' /etc/pam.d`	View examples
Find included stacks	`grep -RnsE \ '^[[:space:]]*(auth\|account\|password\|session)[[:space:]]+(include\|substack)' \ /etc/pam.d`	View examples
List PAM modules	`find /usr/lib /lib -type f -name 'pam_*.so' -print \ 2>/dev/null \| sort -u`	View examples
Show lock records	`sudo faillock --user alice`	View examples
Reset one lockout	`sudo faillock --user alice --reset`	View examples
Read lockout policy	`grep -Ev '^[[:space:]]*(#\|$)' \ /etc/security/faillock.conf`	View examples
Read access rules	`grep -Ev '^[[:space:]]*(#\|$)' /etc/security/access.conf`	View examples
Read resource limits	`grep -RhvE '^[[:space:]]*(#\|$)' \ /etc/security/limits.conf /etc/security/limits.d`	View examples
Read password quality policy	`grep -RhvE '^[[:space:]]*(#\|$)' \ /etc/security/pwquality.conf \ /etc/security/pwquality.conf.d`	View examples
Test one PAM service	`sudo pamtester login alice authenticate`	View examples
Test account management	`sudo pamtester login alice acct_mgmt`	View examples
Check SSH PAM integration	`sshd -T \| grep -i '^usepam'`	View examples
Read authentication logs	`journalctl _COMM=sudo --since '-15 minutes' --no-pager`	View examples
Identify module package	`rpm -qf /usr/lib64/security/pam_unix.so`	View examples

Identity, Access, and Security · 18 commands

Linux Permissions Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
List permission strings	`ls -l`	View examples
Show a numeric mode	`stat -c '%A %a %U %G %n' file`	View examples
Show current identity	`id`	View examples
Add owner execute	`chmod u+x script.sh`	View examples
Remove group and other write	`chmod go-w file`	View examples
Assign exact symbolic modes	`chmod u=rw,g=r,o= file`	View examples
Set a private file mode	`chmod 640 secrets.env`	View examples
Set a directory mode	`chmod 750 scripts`	View examples
Apply a recursive mode	`chmod -R --preserve-root u=rwX,g=rX,o= project`	View examples
Change a file owner	`sudo chown alice file`	View examples
Change owner and group	`sudo chown alice:developers path`	View examples
Change the owning group	`sudo chgrp developers path`	View examples
Show the current umask	`umask`	View examples
Set a restrictive umask	`umask 027`	View examples
Inherit a directory group	`chmod g+s shared`	View examples
Protect shared entries	`chmod +t shared`	View examples
Find world-writable files	`find . -type f -perm -o=w -print`	View examples
Find executable files	`find . -type f -perm /111 -print`	View examples

Identity, Access, and Security · 15 commands

Linux sudoers Policy and Privilege Delegation Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
List your privileges	`sudo -l`	View examples
List detailed privileges	`sudo -ll`	View examples
Inspect another user's policy	`sudo -U releasebot -ll`	View examples
Validate the complete policy	`sudo visudo --check`	View examples
Parse one policy fragment	`sudo visudo --check \ --file=/etc/sudoers.d/release-operators`	View examples
Safely edit a policy fragment	`sudo visudo --file=/etc/sudoers.d/release-operators`	View examples
Define an operator alias	`User_Alias RELEASE_OPERATORS = %release-operators`	View examples
Define an exact command alias	`Cmnd_Alias API_STATUS = /usr/bin/systemctl --no-pager \ status api.service`	View examples
Grant a read-only service check	`RELEASE_OPERATORS ALL = (root) API_STATUS`	View examples
Grant one noninteractive action	`releasebot ALL = (root) NOPASSWD: /usr/bin/systemctl \ restart api.service`	View examples
Invalidate your timestamp	`sudo -k`	View examples
Set a controlled command path	`Defaults:%release-operators \ secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"`	View examples
Enable I/O logging for a group	`Defaults:%release-operators log_input,log_output`	View examples
List recorded sessions	`sudo sudoreplay --list`	View examples
Test one exact authorization	`sudo -U releasebot -l /usr/bin/systemctl restart \ api.service`	View examples

Identity, Access, and Security · 12 commands

Linux Users and Groups Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Inspect current identity	`id`	View examples
Inspect one user	`id -- deploy`	View examples
Resolve a passwd entry	`getent passwd deploy`	View examples
Resolve a group	`getent group appops`	View examples
Create a local group	`sudo groupadd -- appops`	View examples
Create a home-backed user	`sudo useradd --create-home --shell /bin/bash -- deploy`	View examples
Set a password interactively	`sudo passwd deploy`	View examples
Append a supplementary group	`sudo usermod --append --groups appops -- deploy`	View examples
Inspect password aging	`sudo chage --list deploy`	View examples
Lock password authentication	`sudo usermod --lock -- deploy`	View examples
Expire immediately	`sudo usermod --expiredate 1 -- deploy`	View examples
Delete after review	`sudo userdel --remove -- deploy`	View examples

Identity, Access, and Security · 12 commands

OpenSSH Connections and File Transfer Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Connect to a host	`ssh deploy@example.com`	View examples
Use a non-default port	`ssh -p 2222 deploy@example.com`	View examples
Use a host alias	`ssh production`	View examples
Inspect effective configuration	`ssh -G production`	View examples
Show a public-key fingerprint	`ssh-keygen -lf ~/.ssh/id_ed25519.pub`	View examples
Generate an Ed25519 key	`ssh-keygen -t ed25519 -a 64 -C 'deploy access'`	View examples
Load a key into the agent	`ssh-add ~/.ssh/id_ed25519`	View examples
Forward a local port	`ssh -N -L 127.0.0.1:15432:db.internal:5432 bastion`	View examples
Forward a remote port	`ssh -N -R 127.0.0.1:18080:localhost:8080 server`	View examples
Copy one file	`scp -- report.pdf deploy@example.com:/srv/reports/`	View examples
Open an SFTP session	`sftp deploy@example.com`	View examples
Trace connection setup	`ssh -vvv production`	View examples

Identity, Access, and Security · 20 commands

OpenSSL TLS and Certificate Inspection Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Show OpenSSL build details	`openssl version -a`	View examples
Summarize a PEM certificate	`openssl x509 -in server.crt -noout -subject -issuer \ -serial -dates`	View examples
Inspect critical extensions	`openssl x509 -in server.crt -noout -ext \ subjectAltName,keyUsage,extendedKeyUsage,basicConstraints`	View examples
Compute a SHA-256 fingerprint	`openssl x509 -in server.crt -noout -fingerprint -sha256`	View examples
Test the renewal window	`openssl x509 -in server.crt -noout -checkend 2592000`	View examples
Check a DNS identity	`openssl x509 -in server.crt -noout -checkhost \ www.example.com`	View examples
Verify a server chain	`openssl verify -purpose sslserver -CAfile roots.pem \ -untrusted intermediates.pem server.crt`	View examples
Verify chain and hostname	`openssl verify -purpose sslserver -verify_hostname \ www.example.com -CAfile roots.pem -untrusted \ intermediates.pem server.crt`	View examples
Verify a live TLS endpoint	`openssl s_client -connect www.example.com:443 \ -servername www.example.com -verify_hostname \ www.example.com -verify_return_error </dev/null`	View examples
Show certificates sent by a server	`openssl s_client -connect www.example.com:443 \ -servername www.example.com -showcerts </dev/null`	View examples
Require TLS 1.3	`openssl s_client -connect www.example.com:443 \ -servername www.example.com -tls1_3 -brief </dev/null`	View examples
Inspect SMTP STARTTLS	`openssl s_client -starttls smtp -connect \ mail.example.com:25 -servername mail.example.com \ -verify_hostname mail.example.com </dev/null`	View examples
Request stapled OCSP	`openssl s_client -connect www.example.com:443 \ -servername www.example.com -status </dev/null`	View examples
Inspect and verify a CSR	`openssl req -in request.csr -noout -text -verify`	View examples
Check a private key	`openssl pkey -in server.key -check -noout`	View examples
Extract a public key	`openssl pkey -in server.key -pubout -out \ server-public.pem`	View examples
Inspect PKCS#12 metadata	`openssl pkcs12 -in identity.p12 -info -noout`	View examples
Extract certificates only	`openssl pkcs12 -in identity.p12 -nokeys -out \ certificates.pem`	View examples
Convert DER certificate to PEM	`openssl x509 -inform DER -in server.der -outform PEM \ -out server.pem`	View examples
Extract certificate public key	`openssl x509 -in server.crt -pubkey -noout -out \ certificate-public.pem`	View examples

Identity, Access, and Security · 20 commands

SELinux Administration and Troubleshooting Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Read current mode	`getenforce`	View examples
Inspect SELinux status	`sestatus`	View examples
Show file contexts	`ls -ldZ /srv/reporting /srv/reporting/index.html`	View examples
Show process domains	`ps -eZ \| grep '[h]ttpd'`	View examples
Find recent denials	`sudo ausearch -m \ AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent`	View examples
Analyze audit log	`sudo sealert -a /var/log/audit/audit.log`	View examples
Compare expected label	`matchpathcon -V /srv/reporting/index.html`	View examples
Add persistent mapping	`sudo semanage fcontext -a -t httpd_sys_content_t \ '/srv/reporting(/.*)?'`	View examples
Apply expected labels	`sudo restorecon -Rv /srv/reporting`	View examples
Remove local mapping	`sudo semanage fcontext -d '/srv/reporting(/.*)?'`	View examples
Inspect service booleans	`getsebool -a \| grep '^httpd_'`	View examples
Change boolean temporarily	`sudo setsebool httpd_can_network_connect on`	View examples
Persist a boolean	`sudo setsebool -P httpd_can_network_connect on`	View examples
Inspect allowed ports	`sudo semanage port -l \| grep '^http_port_t'`	View examples
Authorize a custom port	`sudo semanage port -a -t http_port_t -p tcp 8443`	View examples
Set system permissive temporarily	`sudo setenforce 0`	View examples
Persist a permissive domain	`sudo semanage permissive -a httpd_t`	View examples
Re-enforce a domain	`sudo semanage permissive -d httpd_t`	View examples
Search allow rules	`sesearch -A -s httpd_t -t httpd_sys_content_t -c file -p \ read`	View examples
List policy modules	`sudo semodule -lfull`	View examples

Identity, Access, and Security · 20 commands

SSSD and Directory Integration Cheat Sheet

Open full cheat sheet

Use	Syntax	Examples
Show SSSD version	`sssd --version`	View examples
List configured domains	`sssctl domain-list`	View examples
Check domain health	`sudo sssctl domain-status --all example.com`	View examples
Validate configuration	`sudo sssctl config-check`	View examples
Check secret-file permissions	`stat -c '%a %U:%G %n' /etc/sssd/sssd.conf`	View examples
Trace a user lookup	`sudo sssctl user-checks alice@example.com`	View examples
Resolve through NSS	`getent passwd 'alice@example.com'`	View examples
Resolve groups	`id 'alice@example.com'`	View examples
Evaluate access policy	`sudo sssctl user-checks -a acct -s sshd \ 'alice@example.com'`	View examples
Discover a realm	`realm discover example.com`	View examples
List realm configuration	`realm list`	View examples
Join a realm interactively	`sudo realm join --user=join-operator example.com`	View examples
Leave a realm	`sudo realm leave example.com`	View examples
List host principals	`sudo klist -k /etc/krb5.keytab`	View examples
Query LDAP discovery records	`dig +short SRV _ldap._tcp.example.com`	View examples
Query Kerberos records	`dig +short SRV _kerberos._tcp.example.com`	View examples
Expire one cached user	`sudo sss_cache --user 'alice@example.com'`	View examples
Expire one domain cache	`sudo sss_cache --domain example.com`	View examples
Read service logs	`journalctl -u sssd.service --since '-15 minutes' \ --no-pager`	View examples
Analyze recent requests	`sudo sssctl analyze request list`	View examples

Back to Identity, Access, and Security cheat sheets