Cybersecurity Triage
Read-onlyCheck Whether Patches Require Reboot
After package updates, you need to know whether the system is signaling a required reboot and which packages triggered it.
Command
test -f /var/run/reboot-required && printf 'reboot-required\n' && cat /var/run/reboot-required.pkgsBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not reboot immediately from this output alone; coordinate service impact and maintenance policy.
Expected output
A reboot-required marker plus package names that requested a reboot.
System impact
Read-only. Nothing changes. The command checks marker files and prints packages associated with the reboot requirement.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use after kernel, libc, OpenSSL, or unattended security updates to plan reboot timing.
When not to use it
Do not reboot immediately from this output alone; coordinate service impact and maintenance policy.
next steps
Related commands
Build a Recent Apt Patch Timeline
Apt history turns patch claims into timestamps and package names.
awk '/^(Start-Date|Commandline|Upgrade|End-Date)/ {print}' /var/log/apt/history.log
Find Services Needing Restart After Patches
A patched library does not protect a process still using the old one.
needrestart -b | sed -n 's/^NEEDRESTART-SVC: //p'
Find SSH Keys for nologin Users
A nologin shell does not automatically mean SSH keys are irrelevant.
comm -12 <(awk -F: '$7 !~ /(bash|sh|zsh)$/ {print $1}' /etc/passwd | sort) <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort)
Find Common Admin Probe Paths
A site does not need WordPress to receive WordPress-looking probes.
awk '$7 ~ /(admin|login|wp-|phpmyadmin)/ {print $1, $7, $9}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
Preview Security Impact of dist-upgrade
Kernel and dependency security fixes may only appear in the broader upgrade plan.
apt-get -s dist-upgrade | awk '/^Inst/ {print}'
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.