linux commands

I had to take a closer look at a distributed attack on one of our web servers today. The attack only involved around 50 hosts which seemed to be testing our URL parameters for injection susceptibility. Coldfusion has some protection against SQL injection, and we take extra steps, as every programmer should, to guard against it.

After identifying the attack vector, I was able to grep the log file for the signature of the attack which was present in the URL information.

A very neat command I learned about today is the watch command. This command line program executes a command periodically and shows the output in full screen. If you've ever used the top command, it's the same concept, but you can use any command.

For example, the command sudo watch cat /proc/meminfo will display the current memory information, updating it every two seconds by default, until the ctrl + c combination is pressed.

The mail command is a powerful command used to manage your local mail on a *nix box. I use the mail command in (k)ubuntu frequently and have root's mail forwarded to my account on my boxes.

To use mail, you'll have to install the mailx package in (k)ubuntu.

$ sudo apt-get install mailx

When you login to your linux box via the command line you might see a message such as this:

jsteelsmith@localhost-10:~$ ssh user@example.com
Linux jacob-desktop 2.6.24-19-generic #1 SMP Wed Jun 18 14:43:41 UTC 2008 i686

One of the coolest commands in Linux is fortune. =)

$ fortune

If you don't have fortune installed:

$ sudo apt-get install fortune-mod fortunes

The above command will output a random fortune, quote or saying. This command has been around forever and it's one of my favourites. The better email clients will allow you to use the command to append a random quote at the end of your emails.

A good way to get local disk information is using the fdisk command. Under Ubuntu, it goes a little something like this.

$ sudo fdisk -l

Don't forget the sudo, or you will only get the devices you plugged in (like USB hard drives).

The output of the command looks like this:

One of the many powerful features of the GNU/Linux command line is the pipe character. The pipe character, or | is used to pipe the output of one command to the input of another command. For example, if you wanted to view all of the lines in a log file that have the number 500 in them (as I did on today on an Windows box), you could use this:

$ grep ' 500 ' file.log | less