Skip to main content
Ctrl+K

Bash for Cybersecurity

Front Matter

  • Title Page
  • Contents
  • Preface

Part I. Linux Command-Line Foundations

  • Part I. Linux Command-Line Foundations
  • 1. The Terminal and the Shell
    • 1.1. Unix History, Linux, and Authorized Practice
    • 1.2. Using the Terminal, Discovering Commands, and Getting Help
    • 1.3. Kernels, Shells, and Processes
    • 1.4. Filesystem Hierarchy
    • 1.5. Assignments
      • 1.5.1. Preview
      • 1.5.2. Lab
      • 1.5.3. Homework
      • 1.5.4. Project
  • 2. Filesystem Management
    • 2.1. Paths and Navigation
    • 2.2. Creating, Copying, Moving, and Safely Removing Files
    • 2.3. File Attributes & Links
    • 2.4. Editing Text Files and Inspecting Hidden Configuration
    • 2.5. Finding Files and Organizing a Working Directory
    • 2.6. Assignments
      • 2.6.1. Preview
      • 2.6.2. Lab
      • 2.6.3. Homework
      • 2.6.4. Project
  • 3. Access Control
    • 3.1. Users, Groups & Privileges
    • 3.2. Reading and Changing Permissions and Ownership
    • 3.3. Default Permissions, Special Bits, and Permission Audits
    • 3.4. Assignments
      • 3.4.1. Preview
      • 3.4.2. Lab
      • 3.4.3. Homework
      • 3.4.4. Project
  • 4. Files, Streams, and Pipes
    • 4.1. Everything Is a File
    • 4.2. Inspecting Text with head, tail, less, and grep
    • 4.3. Pipes, Redirection, and Simple Log Summaries
    • 4.4. Assignments
      • 4.4.1. Preview
      • 4.4.2. Lab
      • 4.4.3. Homework
      • 4.4.4. Project

Part II. Bash Programming Foundations

  • Part II. Bash Programming Foundations
  • 5. Command Syntax and Quoting
    • 5.1. Command Arguments and Quoting
    • 5.2. Your First Bash Script
    • 5.3. Assignments
      • 5.3.1. Preview
      • 5.3.2. Lab
      • 5.3.3. Homework
      • 5.3.4. Project
  • 6. Variables, Expansion, and Arrays
    • 6.1. Variables & Expansion
    • 6.2. Parameter Substitution
    • 6.3. Arithmetic and String Operations
    • 6.4. Arrays
    • 6.5. Environment Variables, PATH, and Safe Command Lookup
    • 6.6. Assignments
      • 6.6.1. Preview
      • 6.6.2. Lab
      • 6.6.3. Homework
      • 6.6.4. Project
  • 7. Operators and Tests
    • 7.1. Arithmetic for Counts, Limits, and Thresholds
    • 7.2. Comparing Values and Combining Conditions
    • 7.3. Testing Strings, Files, and Permissions
    • 7.4. Exit Status and Preflight Checks
    • 7.5. Assignments
      • 7.5.1. Preview
      • 7.5.2. Lab
      • 7.5.3. Homework
      • 7.5.4. Project
  • 8. Control Flow and Script Interfaces
    • 8.1. if/elif/else and case Statements
    • 8.2. Loops: for, while, and until
    • 8.3. Loop Control: break and continue
    • 8.4. Arguments, Input, Usage Messages, and Options with getopts
    • 8.5. Assignments
      • 8.5.1. Preview
      • 8.5.2. Lab
      • 8.5.3. Homework
      • 8.5.4. Project
  • 9. Functions and Modular Scripts
    • 9.1. Defining Functions
    • 9.2. Local vs Global
    • 9.3. Function Output, Return Status, and Calling Contracts
    • 9.4. Building and Checking Reusable Function Libraries
    • 9.5. Assignments
      • 9.5.1. Preview
      • 9.5.2. Lab
      • 9.5.3. Homework
      • 9.5.4. Project

Part III. Streams, Logs, and Robust Automation

  • Part III. Streams, Logs, and Robust Automation
  • 10. Streams and Redirection
    • 10.1. Standard Streams and File Descriptors
    • 10.2. Advanced Redirection, Pipeline Status, and Subshell Boundaries
    • 10.3. Process Substitution
    • 10.4. Assignments
      • 10.4.1. Preview
      • 10.4.2. Lab
      • 10.4.3. Homework
      • 10.4.4. Project
  • 11. Text Processing, Regular Expressions, and JSON
    • 11.1. Regular Expressions and Reliable Text Matching
    • 11.2. Transforming Records with cut, tr, sort, and uniq
    • 11.3. Editing Text Streams with sed
    • 11.4. Processing Fields and Summarizing Logs with awk
    • 11.5. JSON with jq
    • 11.6. Assignments
      • 11.6.1. Preview
      • 11.6.2. Lab
      • 11.6.3. Homework
      • 11.6.4. Project
  • 12. Logs, Reports, and Evidence Files
    • 12.1. Structured Logs, Timestamps, and Report Formats
    • 12.2. Report Templates with Here-Documents and printf
    • 12.3. Evidence Files, Hashes, and Collection Records
    • 12.4. Assignments
      • 12.4.1. Preview
      • 12.4.2. Lab
      • 12.4.3. Homework
      • 12.4.4. Project
  • 13. Error Handling and Defensive Scripting
    • 13.1. Exit Codes, Error Propagation, and Failure Policies
    • 13.2. Shell Options, Traps, and Cleanup
    • 13.3. Debugging with bash -n, Tracing, and ShellCheck
    • 13.4. Input Validation, Temporary Files, and Safe Script Behavior
    • 13.5. Testing Success, Failure, and Recovery
    • 13.6. Assignments
      • 13.6.1. Preview
      • 13.6.2. Lab
      • 13.6.3. Homework
      • 13.6.4. Project

Part IV. Linux Operations and Remote Administration

  • Part IV. Linux Operations and Remote Administration
  • 14. Processes and System Monitoring
    • 14.1. Process Relationships, Signals, and Termination
    • 14.2. Job Control
    • 14.3. Memory, Disk Capacity, and Resource Pressure
    • 14.4. Establishing Baselines and Investigating Unusual Processes
    • 14.5. Assignments
      • 14.5.1. Preview
      • 14.5.2. Lab
      • 14.5.3. Homework
      • 14.5.4. Project
  • 15. Services, Packages, and systemd
    • 15.1. Installing, Updating, and Inspecting Packages
    • 15.2. Boot, Service Dependencies, and systemctl
    • 15.3. journalctl and Service Logs
    • 15.4. Writing Units and Reviewing Service Privileges
    • 15.5. Assignments
      • 15.5.1. Preview
      • 15.5.2. Lab
      • 15.5.3. Homework
      • 15.5.4. Project
  • 16. Scheduling and Job Automation
    • 16.1. Scheduling with cron, at, and systemd Timers
    • 16.2. Reliable Scheduled Jobs: Environment, Locks, and Logs
    • 16.3. Safe Batches and Bounded Parallelism with xargs
    • 16.4. Assignments
      • 16.4.1. Preview
      • 16.4.2. Lab
      • 16.4.3. Homework
      • 16.4.4. Project
  • 17. Networking and Remote Access
    • 17.1. Addresses, Ports, DNS, Routes, and Listening Services
    • 17.2. Diagnosing Connections with ip, ss, ping, and curl
    • 17.3. SSH Authentication and Remote Execution
    • 17.4. Secure File Transfer: SCP and Rsync
    • 17.5. Network Checks, Timeouts, and Failure Reports
    • 17.6. Assignments
      • 17.6.1. Preview
      • 17.6.2. Lab
      • 17.6.3. Homework
      • 17.6.4. Project
  • 18. Backups, Archives, and Recovery
    • 18.1. Creating and Inspecting Archives
    • 18.2. Backup Scripts, Retention, and Offsite Copies
    • 18.3. Restore Testing and Recovery Verification
    • 18.4. Assignments
      • 18.4.1. Preview
      • 18.4.2. Lab
      • 18.4.3. Homework
      • 18.4.4. Project

Part V. Cybersecurity Automation

  • Part V. Cybersecurity Automation
  • 19. Secure Configuration and Audit Automation
    • 19.1. Permission and Ownership Audits
    • 19.2. Account, SSH, and Service Configuration Checks
    • 19.3. Secret Exposure and File Integrity Checks
    • 19.4. Repeatable Audit Reports and Change Verification
    • 19.5. Assignments
      • 19.5.1. Preview
      • 19.5.2. Lab
      • 19.5.3. Homework
      • 19.5.4. Project
  • 20. Triage and Incident Response Scripts
    • 20.1. Host Triage and Volatile State Collection
    • 20.2. Log Review, Time Windows, and Event Correlation
    • 20.3. Indicator Matching, Inventory, and Interpretation Limits
    • 20.4. Assembling and Verifying an Incident Collection and Report
    • 20.5. Assignments
      • 20.5.1. Preview
      • 20.5.2. Lab
      • 20.5.3. Homework
      • 20.5.4. Project

Appendices

  • 1. Bash Cheat Sheet
  • 2. Debugging Guide
  • 3. POSIX vs Bash
  • 4. Security
  • 5. Further Reading
  • 6. Version Control
  • 7. Host Audit Toolkit
    • 7.4. Plan the Audit Scope
    • 7.5. Integrate Checks and Reports
    • 7.6. Test the Toolkit
    • 7.7. Package a Reproducible Toolkit
    • 7.8. Demonstrate and Explain the Toolkit
    • 7.9. Assignments
      • 7.9.1. Preview
      • 7.9.2. Lab
      • 7.9.3. Homework
  • 8. Tooling
    • 8.11. Shell startup and aliases

Bibliography

  • Bibliography

Index

  • Index

Index

A | B | C | D | E | F | G | H | I | K | L | O | P | R | S | T | U | V | W

A

  • Absolute path
  • Authorized practice

B

  • Bash
    • arguments
    • double quotes
    • escaping
    • filename expansion
    • quoting diagnostics
    • safe filename arguments
    • single quotes
    • why Bash
    • word splitting
  • book organization
    • instructors
  • Builtin

C

  • C programming language
  • cat, [1]
  • chapter topics
  • chgrp
  • chmod
  • chown
  • Command option
  • Composition
  • Container
  • contents
  • cover
  • cybersecurity curriculum

D

  • Directory search
  • Directory tree
  • Dotfile

E

  • Execute permission

F

  • file
  • File attribute
  • File descriptor
  • File discovery
  • File operation
  • File permission
  • Filesystem Hierarchy Standard
  • Foreground process

G

  • GID
  • grep
  • Group
  • Group owner

H

  • Hard link
  • head
  • Hidden file, [1]
  • Home directory
  • Host identity
  • Hostname

I

  • Inode

K

  • Kernel

L

  • Least privilege
  • less
  • Linux
    • why Linux
  • Linux distribution
  • Literal match

O

  • Octal notation
  • Owner

P

  • Parent directory
  • Parent process
  • Pathname
  • Permission audit
  • Permission bits
  • Pipe
  • Pipeline, [1]
  • Portability
  • preface
  • Process
  • Process ID
  • Project root
  • Prompt

R

  • Read permission
  • Recursive operation
  • Redirection
  • Relative path
  • Root
  • Root directory

S

  • scripting languages
  • Setgid
  • Setuid
  • Shell
  • sort
  • Special permissions
  • Standard error
  • Standard input
  • Standard output
  • Sticky bit
  • sudo
  • Symbolic link
  • Symbolic mode
  • System call

T

  • tail
  • Terminal
  • Text stream, [1]
  • title page

U

  • UID
  • umask
  • uniq
  • Unix
  • Unix philosophy
  • User

V

  • Virtual machine

W

  • wc
  • Windows Subsystem for Linux (WSL)
  • Working directory, [1]
  • Write permission

By Tsangyao Chen