Exercise: quick system audit

Questions

1. Which service is listening on port 22?
2. Which accounts have a valid login shell?
3. Which files under /etc are world-writable?
4. How much free space is on each mounted filesystem?
5. Which units have failed since the last boot?

Verify

ss -ltnp | grep :22
getent passwd | awk -F: '$7 !~ /(nologin|false)$/ {print $1, $7}'
find /etc -xdev -type f -perm -o+w 2>/dev/null
df -h --output=source,size,avail,pcent,target -x tmpfs -x devtmpfs
systemctl --failed

Commented solution

ss -ltnp | grep :22                       # sshd (pid visible)
getent passwd | awk -F: '$3>=1000 && $7!~/(nologin|false)$/'
find /etc -xdev -type f -perm -o+w        # -xdev: do not descend into other FS
df -h --output=source,size,avail,pcent,target
systemctl --failed