Mission 01 / SYSTEMS / SHELL
Linux Operations
Navigate a Linux filesystem, inspect processes and permissions, and read synthetic system logs.
Briefing
Inspect a synthetic authentication log
Linux exposes operating-system state through files, processes, and small composable commands. This exercise uses a simulated machine and invented log entries; no host commands are executed.
Orient before you change anything
The kernel manages hardware and processes. A shell is a user interface to that system. Start with `pwd` to locate the current directory, `ls` to list files, and `cd` to move. Absolute paths begin at `/`; common service logs live below `/var/log`.
Read access is a security boundary
Linux permissions assign read, write, and execute rights to an owner, a group, and everyone else. `ls -l` displays those bits. Processes run with an identity and only the permissions that identity has. Prefer least privilege; do not change ownership or permissions just to make an error disappear.
Inspect synthetic evidence
Authentication events are represented by one line each. In a real Linux lab, tools such as grep, tail, and journalctl can narrow an authorized log review. The simulator's invented log is: 2026-10-10T09:14:02Z sshd[441]: FAILED password for lab-user from 10.0.4.21 2026-10-10T09:14:08Z sshd[441]: FAILED password for lab-user from 10.0.4.21 2026-10-10T09:15:12Z sshd[519]: ACCEPTED publickey for analyst from 10.0.4.18 Use a read-only filter and count the failed attempts. Never paste classified, CUI, proprietary, or operational logs into public training tools.
Practical exercise
Run the mission
In the simulated shell, inspect `/var/log/auth.log` and count the failed login events.
Progressive hint
Use a read-only filter to find only the failed authentication lines.
Need another hint?
Run `grep FAILED /var/log/auth.log`, then count the matching lines.
MissionStack read-only shell simulator. Type help to see the safe command list.
No operating-system commands or network requests run from this simulator.
Knowledge check