Unit 01 · 1 h 32 min
The shell and the filesystem
Day one on web01: read the prompt, walk the directory tree and open a case folder for your evidence.
Linux Foundations
Take over a real Linux server, investigate what the last admin left behind and harden it like a defender.
- Time
- 21 h 37 min
- Lessons
- 73
- Machine
- Ubuntu 24.04 LTS
What you earn
RootCertificateLinux Foundations, certificate of completion CompTIALinux+CompTIA Linux+ Linux FoundationLFCSLinux Foundation Certified System Administrator
Prepares you for CompTIA Linux+ and Linux Foundation Certified System Administrator. Root is not affiliated with these issuers.
You will be able to
- Navigate the filesystem and read any file from the shell
- Search large logs with grep, pipes and awk
- Audit accounts, groups, keys and permissions
- Map processes, services and listening ports, and unmask a disguised one
- Rebuild an incident timeline from auth and sudo logs
Units and lessons
Unit 02 · 1 h 40 min
Reading and checking files
Identify files by content, read just the part you need and prove whether a file was changed.
Unit 03 · 1 h 58 min
Searching and pipes
Slice a day of web traffic with grep, pipes and awk, and catch a scanner that found something.
Unit 04 · 2 h 4 min
Users and groups
Audit every account on web01: who exists, who can log in, who is root and whose keys open the door.
Unit 05 · 1 h 38 min
Permissions
Read and set permission bits, understand directories and special bits, and fix a secret anyone can read.
Unit 06 · 1 h 42 min
Processes and services
Map what runs on web01, unmask a process dressed as a kernel thread and find what starts it at boot.
Unit 07 · 2 h 2 min
The network from the host
Find every listening port on web01, tie each to a process, query a local service and audit the firewall rules.
- 1Listening ports15 min · machine
- 2Who owns that port15 min · machine
- 3Talking to a local service18 min · machine
- 4Checking reachability14 min · machine
- 5Auditing firewall rules18 min · machine
- 6Case file: checking the box at the edge26 min · machine
- 7Case file: sessions that survive the patch16 min · machine
Unit 08 · 2 h 22 min
Logs and the timeline
Read SSH and sudo logs, trace a brute-force attack, and rebuild the evening someone planted four backdoors.
- 1Where the logs are14 min · machine
- 2Reading auth.log16 min · machine
- 3Tracing an attack16 min · machine
- 4The sudo trail18 min · virtual lab
- 5Building a timeline20 min · machine
- 6Watching sensitive files with auditd18 min · machine
- 7Who did it: reading the audit trail18 min · machine
- 8Case file: mass theft from a file transfer server22 min · machine
Unit 09 · 1 h 39 min
Scheduled tasks and persistence
Audit cron jobs, timers and login scripts, then sweep the disk for everything that comes back after a reboot.
Unit 10 · 1 h 36 min
Packages, signatures and patching
Know what is installed and where it came from, prove packages are untampered, and close the gap between a fix and its install.
Unit 11 · 1 h 18 min
Backups and recovery
Check that backups exist, cannot be destroyed with the server, restore cleanly and come from before the attack.
Unit 12 · 2 h 6 min
Auditing and hardening
Run a defender's checklist on web01, automate it as a script and write findings someone can act on.
Twelve units on one live server, each with a case file from a real incident: navigate, search, audit accounts and keys, verify packages, rebuild a timeline, hunt persistence and restore from backup. You finish with a scripted audit and a ranked report.