Linux For Cybersecurity — Part 10: Capstone Lab — Defend & Investigate a Linux System

You’ve made it! We’ve covered Linux commands, users, networking, scripting, logs, tools, and security. Now it’s time to put it all together in a real-world scenario. Today, you’ll investigate a suspicious Linux system, detect possible intrusions, and secure it.

TL;DR — click here to watch the video and skip to the part where I almost crash a VM.

[embed]

Scenario Setup

Imagine you’re a junior cybersecurity analyst. Your Linux server has been acting strangely — high CPU usage, suspicious logins, and possible network scans. Your mission: investigate and secure the system.

Lab Requirements:

• Any Linux VM (Ubuntu/Debian recommended)
• Tools: nmap, tcpdump, ufw, grep, awk, john, hydra, tshark

Step 1: Check Users and Logins

Commands:

who                      # See who is logged in
last                     # Check login history
sudo grep "Failed password" /var/log/auth.log | tail -10

Goal: Spot failed SSH login attempts or suspicious users.

Tip: Look for repeated failures or logins at unusual hours.

Step 2: Investigate Running Processes

Commands:

ps aux --sort=-%cpu | head   # Top CPU processes
netstat -tulnp               # Active network connections

Goal: Identify suspicious processes (e.g., unknown binaries listening on unusual ports).

Step 3: Scan the System with Nmap (External View)

From another VM or machine:

nmap -sV 192.168.1.X

Goal: See what an attacker sees → exposed services.

Unnecessary services = attack surface.

Step 4: Capture Network Traffic

Commands:

sudo tcpdump -i eth0 -c 50 -w capture.pcap

Open in Wireshark or TShark:

• Look for repeated SSH login attempts
• Spot suspicious outbound traffic

Wireshark showing SYN floods or repeated login attempts.

Step 5: Check for Weak Passwords

Commands:

sudo unshadow /etc/passwd /etc/shadow > hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Goal: Detect weak or cracked passwords.

“Weak password = easy entry.”

Step 6: Secure the System

Commands:

sudo apt update && sudo apt upgrade -y    # Patch system
sudo ufw enable                           # Enable firewall
sudo ufw allow ssh                        # Allow SSH
sudo ufw deny 23                          # Block Telnet if running
sudo passwd -l suspicioususer             # Lock compromised accounts

Goal: Harden the server against future attacks.

Step 7: Document Findings

Document everything: suspicious logins, running services, weak passwords. Then recommend fixes:

• Enforce key-based SSH authentication
• Patch software regularly
• Monitor logs for anomalies

“Congratulations! You just completed a mini Linux cybersecurity investigation. You identified suspicious logins, analyzed traffic, cracked weak passwords, and secured the system.”

This is what real-world cybersecurity looks like — combining commands, tools, and critical thinking.

If you enjoyed this series, keep practicing with your own Linux labs, explore advanced tools like Snort, Suricata, or ELK, and continue your journey toward becoming a cybersecurity professional.

Access the complete series here:

[embed]Linux For CyberSecurity Edit descriptionmedium.com