# Linux interview answers that name the evidence Source: https://ai.techclick.in/blog_linux_interview Markdown: https://ai.techclick.in/blog_linux_interview.md Publisher: Techclick Infosec Pvt Ltd Linux interview questions and answers (2026) for security and network engineers: eight production scenarios on permissions, processes, journalctl, ss/netstat, and iptables/nft — plus a scored quiz. Say this out loud Linux access is inode mode bits, not a vibe. Sticky on a directory is restricted deletion. SUID on an executable changes the effective UID at execve . A process is a PID plus a unit. A socket is a 5-tuple I prove with ss -lntup — bare ss omits listeners. Packets to a local socket walk INPUT ; packets routed through the box walk FORWARD . First terminating verdict wins. I prove it in the journal with FIELD=VALUE , then I do not flush the live ruleset. ## 1. Ticket hook — SSH down, 4444 open Night shift. Users cannot SSH to the jump box. systemctl is-active ssh says failed on Ubuntu; a colleague already typed systemctl restart sshd on the same host and got “Unit sshd.service not found.” ss with no flags shows established sessions and nothing on 22. A junior pastes ss -lntup and there it is: 0.0.0.0:4444 owned by a process named python3 . Another junior wants iptables -F “to see if the firewall is the problem” and chmod 777 /home “so support can copy logs.” That is the interview. Debian-family units are often ssh.service ; RHEL-family are sshd.service . ss without -l or -a hides listening sockets — ss(8) says so in the first options paragraph. Flushing the filter table deletes every rule in every chain of that table. World-writable home directories are not a log-collection strategy. Hero · who talks to whom Notice: the box is not one tool. You prove a file (mode bits), a process (PID / unit), a socket (ss), then the journal field that ties them together. Hard words, once Mode bits — the 12 bits in st_mode : 9 permission bits plus SUID (04000), SGID (02000), sticky (01000). SUID — on an executable, execve(2) sets the process effective UID to the file owner. SGID — on an executable, effective GID follows the file group; on a directory, new files inherit that directory’s GID. Sticky / restricted deletion — on a directory, an unprivileged user may unlink or rename a file only if they own the file or the directory. Unit — a systemd object ( sshd.service , nftables.service ). Journal field — a KEY=value match such as _SYSTEMD_UNIT= or _PID= . Terminating verdict — ACCEPT / DROP (iptables) or accept / drop (nft) stops further rule evaluation in that chain. ## 2. Mental model: five stations on the box Interviewers mix file, process, socket, filter, and log on purpose. Keep them on different stations. A listener is not a firewall hole. A failed unit is not a closed port. A world-writable directory is not “the same as 777 on the file.” #### What the kernel owns Inode mode, process credentials, the socket table, and the netfilter hooks. ss reads the socket table. nft list ruleset / iptables -S read the filter tables. Neither tool invents a file permission. #### What the engineer owns Which station to prove first, the exact flag that reveals listeners, the journal match that scopes one unit and one boot, and the refusal to flush or chmod -R 777 before a backup and a ticket. Path · five stations Notice: process sits between perms and socket. A SUID binary becomes a privileged PID; that PID owns a listener; the filter may still drop the SYN; the journal records the unit. ### Mode bits you must say without looking them up chmod(1) numeric mode is up to four octal digits. The first digit is special: 4 set-user-ID, 2 set-group-ID, 1 sticky / restricted deletion. The next three are owner, group, other — each 4 read, 2 write, 1 execute (or search, on a directory). 1777 on /tmp is world-writable and sticky. That is not the same as 0777 . In ls -l , SUID shows as s in the owner execute slot (capital S if execute is off). SGID is s / S in the group slot. Sticky is t / T in the other slot. inode(7) is the page that defines those bits; chmod(1) is the page that changes them. ## 3. Investigation decision flow Flowchart first. You do not start by flushing nftables. You start by naming the symptom: file, process, listener, or packet path — then you pick the proof command that can falsify it. Flow 1 · investigate the box Linux interview investigation: classify the symptom, prove the station, then act - Ticket SSH / port / deny Which station? file · PID · socket · hook Prove, do not guess one command per station Quote the field then change one thing Perms ls -l · stat · find -perm SUID / SGID / sticky Process systemctl status · ps unit before kill -9 Socket ss -lntup · -p PID LISTEN is not default Filter + journal nft list · journalctl -u never -F first Local socket or routed? INPUT vs FORWARD TO US filter INPUT / inet input ss shows the listener THROUGH US filter FORWARD ss on this box is silent First terminating verdict wins iptables ACCEPT/DROP and nft accept/drop stop the walk. A later DROP never runs. Policy applies only if nothing terminated. iptables -F and nft flush ruleset delete the proof. Snapshot first: iptables-save or nft list ruleset. Read left → right, then down. Diamond = local vs forwarded. Do not jump to the filter table until you know which hook the packet actually hits. Decision · two paths Path A is traffic to a local socket (INPUT). Path B is traffic the box routes (FORWARD). Same host, different chain. Caption in this lesson — do not invent labels from the picture. ## 4. How to choose the tool Use the man-page words in the room. ss is iproute2 and is the modern socket dump. netstat is net-tools and is often not installed. On current distributions iptables may be the iptables-nft compatibility wrapper — iptables -V tells you. The kernel truth on an nft backend is nft list ruleset . Question First tool Why this, not that Proof line Who can unlink this file? ls -ld the directory + ls -l the file Sticky is a directory bit. File mode 644 does not decide unlink. drwxrwxrwt → only owner / dir owner / root Unexpected privilege? find / -perm -4000 -type f -perm -4000 means the SUID bit is set. Exact -perm 4000 is the wrong test. ls -l shows rws ; stat shows 4755 Service failed this boot? systemctl status UNIT then journalctl -u UNIT -b -b is this boot. Grep on /var/log/messages misses structured fields and user journals. _SYSTEMD_UNIT= + exit status What is listening? ss -lntup Bare ss lists non-listening / established only. -l is listeners; -p is the process. LISTEN 0 128 0.0.0.0:22 users:(("sshd",pid=…)) Packet to this host dropped? nft list ruleset or iptables -S INPUT / type filter hook input . Counters on the matching rule, not a reboot. First drop / DROP with a hit count Packet through this router dropped? Same tools, FORWARD chain A listener on this box will not appear. Do not debug with ss alone. FORWARD policy + first terminating rule Common miss Treating ss and netstat -lntp as identical, then declaring “nothing is listening.” ss(8) : when no option is used it displays open non-listening sockets. Add -l or -a . Numeric ports need -n so you do not wait on a broken resolver. Process owners need -p (and usually root). ## 5. Do: perms → process → socket → journal Side A proves the file and the process. Side B proves the socket and the filter hook. Side C is the close-out you say so the interviewer knows you will not flush the live table. Primary sources for this block: chmod(1) / inode(7) , ss(8) , journalctl(1) , iptables(8) . ### Side A — File and process #### Read the directory, not only the file ls -ld /path then ls -l /path/file . If the directory is world-writable and the last character is not t , any local user can unlink another user’s file. That is the sticky-bit ticket. - #### Hunt unexpected SUID / SGID find / -xdev -perm -4000 -type f 2>/dev/null and the same with -2000 for SGID. Confirm with stat -c '%a %A %n' FILE . Do not “fix” a vendor SUID binary with chmod 755 until you know why it is there ( passwd , sudo are supposed to be SUID). - #### Name the unit before you kill a PID systemctl status ssh.service sshd.service --no-pager . Then ps -eo pid,user,stat,pcpu,pmem,cmd --sort=-pcpu | head . A Z in STAT is a zombie — you fix the parent, you do not kill -9 the corpse. ### Side B — Socket and filter (training mock) Primary source: ss(8) usage examples plus the default-options paragraph. Then iptables(8) TARGETS (first match of ACCEPT / DROP ends the walk) or nft list ruleset on an nft host. root@jump01:~# ss -lntup ; journalctl -u ssh.service -b -n 8 --no-pager Training mock · not live root · /root · evidence desk ### ss -lntup Netid State Recv-Q Send-Q Local Address:Port Process tcp LISTEN 0 128 0.0.0.0:22 users:(("sshd",pid=812,fd=3)) tcp LISTEN 0 128 0.0.0.0:4444 users:(("python3",pid=4401,fd=5)) tcp LISTEN 0 511 0.0.0.0:80 users:(("nginx",pid=1022,fd=8)) ### journalctl -u ssh.service -b -n 6 -- Boot 7c2a… current -- sshd[812]: Failed password for invalid user admin from 203.0.113.44 port 51822 ssh2 sshd[812]: Accepted publickey for jump from 10.20.8.14 port 51102 ssh2 sshd[812]: pam_unix(sshd:session): session opened for user jump(uid=1001) Training mock · not live. Notice the flags: -l listening, -n numeric, -t TCP, -u UDP, -p process. Bare ss would have hidden every LISTEN line. Journal scoped with -u and -b (this boot). Side B commands — quote one line each ss -lntup ss -o state established '( dport = :ssh or sport = :ssh )' iptables -V iptables -S nft list ruleset journalctl -u ssh.service -u sshd.service -b --no-pager journalctl _COMM=sshd PRIORITY=3 -b ### Side C — Close the ticket without wrecking the box - #### Snapshot the filter before you touch it iptables-save > /root/iptables.$(date +%F).rules or nft list ruleset > /root/nft.$(date +%F).nft . nft(8) is explicit: list ruleset output is valid input to nft -f . That is the restore path. -F / flush ruleset is not a debug flag. - #### Change one station Stop the unexpected listener’s unit or PID, or insert one drop rule with a comment, or restore sticky on the share. Do not combine chmod -R 777 , iptables -F , and a reboot in the same change window. - #### Retest the original symptom SSH from the same client. Re-run ss -lntup and journalctl -u … -b -n 20 . If the ticket was a routed flow, retest that flow — a ping to the firewall itself is INPUT, not FORWARD. ## 6. Runtime path: packet vs local socket After go-live the box is either a host, a router, or both. iptables(8) tables: filter is the default. Built-in chains: INPUT (packets destined to local sockets), FORWARD (packets routed through the box), OUTPUT (locally generated). Compatibility note in the same page: unlike ipchains, a forwarded packet does not walk INPUT then FORWARD then OUTPUT — it walks FORWARD only. Flow 2 · first packet on this host Packet arrives: route decision splits INPUT (local socket) from FORWARD (routed) - Ingress NIC SYN / UDP Dest is local? route / fib YES filter INPUT / hook input first ACCEPT or DROP Local socket ss -lntup proves it NO filter FORWARD not INPUT, not ss Egress NIC routed through Policy runs only if no rule terminated. A broad ACCEPT above a DROP hides the DROP forever — same first-match story as a firewall rulebase. Read the diamond first. Local destination → INPUT → ss can see the socket. Routed → FORWARD → ss on this host is the wrong evidence. Proof · cockpit Notice: proof is a pair — a listener line and a journal line — not a green dashboard. Illegible terminal text is mood; you still quote the real flags in the runbook. ## 7. Eight interview scenarios ### Q1 · Scenario — world-writable share, missing sticky Devs share /srv/drop as drwxrwxrwx . Alice’s build artifact vanished. Bob admits he ran rm /srv/drop/* to “clean junk.” What bit was missing, and what do you set? Direct answer The restricted deletion flag — sticky bit — on the directory. chmod(1) and inode(7) : on a directory it stops an unprivileged user from removing or renaming a file they do not own, unless they own the directory. Set it with chmod +t /srv/drop or chmod 1777 /srv/drop if you truly need world-writable. Confirm ls -ld ends in t . Why production cares /tmp is 1777 for this reason. A CI drop box without sticky is a cross-user delete bug, not a mystery. Weak answer / trap “Make it 755 so only root can write” (breaks the share) or “chmod 777 the files” (does not control unlink). Unlink is a directory operation. #### Strong framing (say this) Unlink checks the directory. Sticky is restricted deletion. I want drwxrwxrwt , then I name Alice as the file owner. #### Evidence to name ls -ld /srv/drop ; stat -c '%a %A' /srv/drop ; chmod(1) “Restricted deletion flag or sticky bit”; inode(7) S_ISVTX . ### Q2 · Evidence — unexpected SUID binary IR asks whether anything SUID appeared under /opt after a vendor install. What command proves the bit, and what must you not do first? Direct answer find /opt -perm -4000 -type f (and -2000 for SGID). find(1) : -perm -mode means all of those bits are set. Then ls -l / stat to show rws and the numeric 4xxx. Do not chmod a-s blindly — passwd and sudo are supposed to be SUID root. Why production cares SUID root is an instant privilege boundary. A random /opt/vendor/bin/helper with 4755 is a finding. A missing SUID on /usr/bin/passwd is also a finding. Weak answer / trap find -perm 4000 (exact mode 4000, almost never a hit) or “I ran chmod -R 755 / to be safe.” #### Strong framing (say this) -perm -4000 is “SUID is on,” not “mode equals 4000.” I compare the list to the distro baseline before I strip the bit. #### Evidence to name find(1) -perm -mode ; chmod(1) first octal digit 4; inode(7) S_ISUID / execve(2) . ### Q3 · Troubleshoot — unit not found, SSH still down A colleague ran systemctl restart sshd on Ubuntu 24.04 and got “Unit sshd.service not found.” Users still cannot log in. First check? Direct answer List the real unit, then read this boot’s journal. systemctl list-units '*ssh*' (Debian/Ubuntu ship ssh.service ; RHEL-family ship sshd.service ). Then systemctl status ssh.service --no-pager and journalctl -u ssh.service -b . Do not reboot to “refresh systemd.” Why production cares Wrong unit name looks like a down daemon. The listener may be up under the other name, or the unit may have failed on a bad sshd_config after the last restart. Weak answer / trap killall sshd then sshd & from a shell — no unit, no journal, no restart policy. #### Strong framing (say this) I resolve the unit name first. Then I read journalctl -u … -b for the ExecStart failure, then I look at ss -lntup for :22. #### Evidence to name systemctl status Active / Result / ExecMainStatus; journalctl(1) -u , -b ; _SYSTEMD_UNIT= . ### Q4 · Evidence — SSH brute force in the journal SOC wants failed SSH for the last two hours as structured evidence, not a screenshot of tail . What do you run, and why is /var/log/auth.log not always there? Direct answer journalctl -u ssh.service -u sshd.service --since "2 hours ago" -g "Failed password" (or _COMM=sshd ). journalctl(1) matches are FIELD=VALUE ; -g is a PCRE on MESSAGE= . Debian/Ubuntu often still have rsyslog /var/log/auth.log ; RHEL-family use /var/log/secure ; a journal-only host may have neither file. Members of systemd-journal , adm , or wheel can read the system journal — a normal user cannot. Why production cares SIEM parsers want a stable field, a boot ID, and a timestamp. Grep on a rotated text file loses the current boot and the unit. Weak answer / trap journalctl --vacuum-size=1M to “make logs readable,” or assuming every Linux box has auth.log . #### Strong framing (say this) I query the journal with a unit and a time window. I name the file on disk only as a secondary, distro-specific sink. #### Evidence to name journalctl(1) -u , --since , -g , access groups; systemd.journal-fields(7) _SYSTEMD_UNIT , _PID , PRIORITY ; optional /var/log/auth.log or /var/log/secure . ### Q5 · Compare — ss versus netstat The interviewer says “show me listening TCP.” You type ss and see only ESTAB rows. They smirk. What did you forget, and when is netstat still a fair answer? Direct answer ss with no options shows non-listening sockets (established, and similar). Add -l (listening only) or -a (listening and non-listening). For the interview line use ss -lntup . netstat -lntup is the older equivalent from net-tools; many images no longer ship it. Prefer ss from iproute2 and say so. Why production cares A missed -l produces a false “port 22 is closed” during an outage. That wastes the next twenty minutes on the firewall. Weak answer / trap “ ss replaced netstat so the flags are the same” — they are similar, not identical, and the default filter is the trap. #### Strong framing (say this) Default ss hides LISTEN. I always add -l or -a , -n so DNS cannot stall me, -p for the PID. #### Evidence to name ss(8) “When no option is used”; -l , -a , -p , -n , -t , -u ; example ss -t -a ; netstat(8) if present. ### Q6 · Troubleshoot — unexpected listener on 4444 ss -lntup shows 0.0.0.0:4444 owned by python3 , PID 4401. First move — not the last. Direct answer Identify, do not immediately kill -9 . ps -fp 4401 , tr '\0' ' ' ## Knowledge check Six judgment items. Each maps to a promise bullet. Check answers, then reset and re-read the traps table if you miss any. Q1 /srv/drop is drwxrwxrwx . Bob deletes Alice’s file. What is the first correct fix? chmod 000 /srv/drop so nobody can write chmod +t /srv/drop (restricted deletion / sticky on the directory) chmod 777 Alice’s file so she can restore it chown bob:bob /srv/drop because he cleans it Correct: b . Unlink is a directory operation. Sticky / S_ISVTX is restricted deletion. Re-read Q1 + mode bits. Q2 You run ss with no flags during an SSH outage and see only ESTAB rows. What is true? The kernel hides listeners from everyone except netstat You must reboot before ss can see LISTEN Default ss lists non-listening sockets; add -l or -a (ss -lntup) LISTEN sockets appear only if you are root and omit -n Correct: c . ss(8) : no option → non-listening / established. Re-read Q5 + the runbook mock. Q3 sshd failed after the last reboot. What is the first evidence command? Resolve the unit (ssh vs sshd), then journalctl -u UNIT -b iptables -F so the daemon can bind :22 chmod -R 777 /var/log and reboot journalctl --vacuum-size=1M to drop old noise Correct: a . Wrong unit name is the classic miss. -b scopes this boot. Re-read Q3 + Q4. Q4 A Linux box is the default gateway. Hosts behind it cannot reach 10.50.0.20:443. ss -lntup on the gateway shows no :443. What is true? You must start nginx on the gateway so INPUT can accept 443 nftables has no FORWARD hook — only INPUT exists Transit packets walk FORWARD (hook forward), not INPUT; ss on this host is the wrong proof Add an OUTPUT accept for 443 and the route will appear Correct: c . iptables(8) INPUT = local sockets, FORWARD = routed through. Re-read Flow 2 + Q7. Q5 IR asks for unexpected SUID under /opt . Which first pass is correct? chmod -R 755 /opt to clear the bit, then report clean find /opt -perm -4000 -type f, then stat / ls -l before changing anything ss -lntp | grep suid find /opt -perm 4000 so only exact mode 4000 matches Correct: b . -perm -4000 means the SUID bit is set. Exact 4000 is the wrong test. Re-read Q2. Q6 A junior runs iptables -F “to see if the firewall is the problem.” What just happened? Rules were listed and left in place Only the INPUT policy changed to ACCEPT Every rule in every chain of the filter table was deleted (flush) The command switched the host from nft to iptables-legacy Correct: c . -F with no chain flushes all chains in the table. Snapshot with iptables-save / nft list ruleset first. Re-read Q8 + traps. Check answers Reset ## Sources - chmod(1) — numeric mode, SUID/SGID bits, restricted deletion / sticky on directories such as /tmp - inode(7) — S_ISUID 04000, S_ISGID 02000, S_ISVTX 01000, directory SGID inheritance - find(1) — -perm -mode (all named bits set) versus exact mode - ps(1) — process table, STAT codes - systemctl(1) — unit status, list-units - journalctl(1) — FIELD=VALUE matches, -u , -b , --since , -g , access groups, vacuum commands - systemd.journal-fields(7) — _SYSTEMD_UNIT , _PID , _COMM , PRIORITY - ss(8) — default omits listeners; -l , -a , -p , -n , -t , -u ; state filters - netstat(8) — net-tools predecessor still asked in interviews - iptables(8) — filter INPUT / FORWARD / OUTPUT; first ACCEPT / DROP ; -F flush - nft(8) — list ruleset / flush ruleset ; list output is valid nft -f input - nftables wiki — official HOWTO, hooks, and example rulesets - Linux 2.4 Packet Filtering HOWTO — Using iptables — built-in chains, first terminating target, -F Related: Wireshark interview · SOC analyst interview · CCNA interview · VAPT interview · Interview hub --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt