$ Linux One Liners
Back to cert prep

Unofficial practice

SSH Login Triage

A command fails with access trouble. Read the user, group, mode, and path traversal evidence before changing ownership or permissions.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Try first

sudo tail -80 /var/log/auth.log | grep -E 'Failed|Accepted|publickey'

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

drill evidence

Sample output and answer key

Command anatomy

sudo tail -80 /var/log/auth.log | grep -E 'Failed|Accepted|publickey'
grep
select matching lines
-n
print line numbers when present
-C
show context before and after the match
pattern
the text or regular expression to search
path
the file or directory being inspected

Annotated output

Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice

Usage
the command shape and expected target
--help
quick option reference
man
full local manual page when installed

Safe vs unsafe move

Common wrong move

Treating a practice command as a permission to make a broad production change.

Next safe command

command --help

Goal

Prove the condition with command output before changing the system.

Safe first command

sudo tail -80 /var/log/auth.log | grep -E 'Failed|Accepted|publickey'

Correct interpretation

The decisive fields are `Usage`, `--help`, `man`. The affected object is the exact target named in the output, not the broad subsystem around it. The next safe command is `command --help` because it narrows the evidence without jumping to a broad fix. Watch out for this wrong move: Treating a practice command as a permission to make a broad production change.

Next safe command

command --help

Common wrong move

Treating a practice command as a permission to make a broad production change.

Self-check

Which path component, owner, group, or mode blocks access for the effective user?

source and objective

Related cert objective

Source status: provisional. XK0-005 objective material is available from CompTIA CDN, and newer objective material must be rechecked before this study map is treated as current.

Open related practice area

Related command pages

Why this matters

The point is not to memorize a flag. It is to read the evidence, name the next safe check, and avoid the tempting broad fix.