Cybersecurity Triage
Read-onlyShow the nftables Input Chain
You need to inspect the nftables input chain policy and the key accept or drop rules.
Command
nft list ruleset | sed -n '/chain input/,/}/p'Before you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat a simplified chain excerpt as a complete network policy audit on hosts with multiple tables or namespaces.
Expected output
The nftables input chain with policy and selected TCP port rules.
System impact
Read-only. Nothing changes. nftables prints rules and sed narrows the output to the input chain.
Recovery / rollback: no state is changed.
When to use it
Use when UFW output is not enough or you need to verify the lower-level packet filter shape.
When not to use it
Do not treat a simplified chain excerpt as a complete network policy audit on hosts with multiple tables or namespaces.
next steps
Related commands
Count Failed SSH Login IPs
The loudest SSH source is usually visible with one count.
sed -n 's/.*Failed password .* from \([0-9.]*\) port.*/\1/p' logs/auth.log | sort | uniq -c | sort -nr
Summarize sudo Commands by User
Privilege history is easier to review when users and commands are separated.
sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort
Prove a Package Candidate Is From Security
The package name is not enough; the candidate repository tells the patch story.
apt-cache policy openssl | sed -n '/Installed:/p;/Candidate:/p;/security/p'
Review Kept-Back Packages Before Patching
Kept-back packages are where simple upgrade plans stop being simple.
apt-get -s upgrade | sed -n '/kept back:/,/^Inst/p'
Inspect Container Environment Names
Check what environment variables exist without printing their secret values.
docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' api | sed 's/=.*$/=<redacted>/'
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.