Cybersecurity Triage
Read-only, sensitive outputShow iptables INPUT Rules
You need a concise view of the iptables INPUT chain policy and rules.
Command
iptables -S INPUTBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume iptables output covers nftables-native rules on every modern distribution.
Expected output
INPUT policy and append rules for accepted or dropped traffic.
System impact
Read-only, sensitive output. Nothing changes. iptables prints the INPUT chain in a reusable rule format, but firewall policy can be distro- and stack-specific.
Recovery / rollback: no state is changed.
When to use it
Use on systems where iptables rules may still be active or where tooling reports iptables syntax.
When not to use it
Do not assume iptables output covers nftables-native rules on every modern distribution.
next steps
Related commands
Show the nftables Input Chain
The packet path was hiding below UFW.
nft list ruleset | sed -n '/chain input/,/}/p'
Read UFW Policy Verbosely
The firewall was active, but the defaults mattered more than the rule list.
ufw status verbose
List Numbered UFW Rules
Numbered rules make firewall review less ambiguous.
ufw status numbered
Review sudo Grants
Privilege paths should be visible before you remove or approve access.
awk -F: '$1=="sudo" {print "sudo group: " $4}' /etc/group; sudo grep -RhnE '^[^#].*ALL=' /etc/sudoers /etc/sudoers.d 2>/dev/null
Show Successful Logins and sudo Use
Access reviews need both who logged in and who elevated privileges.
grep -E 'Accepted publickey|sudo:' /var/log/auth.log 2>/dev/null
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.