$ Linux One Liners
Back to commands

Cybersecurity Triage

Read-only

Find Services Needing Restart After Patches

After security packages are applied, you need to see which services still need restarts.

Command

needrestart -b | sed -n 's/^NEEDRESTART-SVC: //p'

Before you run this

System impact: Read-only. Low when scoped to the shown target.

When not to use it: Do not restart services blindly from this output; coordinate impact and maintenance windows.

Expected output

systemctl restart commands for services that need to load patched libraries.

System impact

Read-only. Nothing changes. needrestart prints batch-mode restart findings and sed extracts service restart commands.

When to use it

Use after OpenSSL, libc, kernel, or web stack updates to plan service restarts and reboot decisions.

When not to use it

Do not restart services blindly from this output; coordinate impact and maintenance windows.

Recovery / rollback

No undo needed because this command only reports restart needs.

next steps

Related commands

Cybersecurity Triage Read-only

Find Held Packages Blocking Patches

A held package can quietly keep a security update out of production.

apt-mark showhold | sed 's/^/held: /'
Cybersecurity Triage Read-only

Check Whether Patches Require Reboot

Some security fixes are not complete until the host boots the new kernel or libraries.

test -f /var/run/reboot-required && printf 'reboot-required\n' && cat /var/run/reboot-required.pkgs
Cybersecurity Triage Read-only

Prove a Package Candidate Is From Security

The package name is not enough; the candidate repository tells the patch story.

apt-cache policy openssl | sed -n '/Installed:/p;/Candidate:/p;/security/p'
Cybersecurity Triage Dry run

Dry-Run Unattended Security Upgrades

Unattended upgrades can explain what they would patch before they patch it.

unattended-upgrade --dry-run --debug 2>&1 | sed -n '/Packages that will be upgraded:/,/^$/p'
Cybersecurity Triage Sensitive output

Summarize sudo Commands by User

Privilege history is easier to review when users and commands are separated.

sed -n 's/.*sudo: *\([^: ]*\).*COMMAND=\(.*\)$/\1 -> \2/p' /var/log/auth.log 2>/dev/null | sort
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.