security

Security-relevant commands and practices

chage

Tested chage examples: reading the ageing settings, expiring passwords on a schedule, forcing a change, and expiring the whole account on a date.
chmod

Tested chmod examples: numeric and symbolic modes, recursive changes, setuid/setgid/sticky bits, permission audits, and troubleshooting.
getent

Tested getent examples: passwd, group, hosts and shadow through NSS, the exit status a script reads, and the members a group listing leaves out.
id

Tested id examples: the three parts of the line, real against effective uid under a setuid binary, and the group a running shell has not picked up.
adduser, useradd and friends

Tested examples for adduser, useradd, usermod, deluser and the group commands: why Debian ships two of each, and the -aG that silently drops every other group.
passwd

Tested passwd examples: setting a password from a script, reading the status line, what a locked password does not stop, and expiring an account instead.
ssh

Tested ssh examples: key-based auth, the config file, host key verification, port forwarding, multiplexing, and reading a failed connection.
sudo

Tested sudo and su examples: running one command as root, what the environment loses on the way, the redirect that still runs as you, and reading sudoers.
The repository is not signed

apt cannot verify a repository's signature: the NO_PUBKEY and Missing key errors. What Debian 13 changed, and why apt-key adv is no longer the fix.
su vs sudo -i vs sudo -s

sudo -i, sudo -s, su and su - leave you as root with different directories and audit trails. Which to type, and why su fails on a stock Debian install.
Installing a .deb by hand

Install a downloaded .deb the way that resolves its dependencies, see what dpkg -i leaves behind when you don't, and read the package before you trust it.
Adding a third-party repository safely

Why apt-key is gone, how Signed-By scopes a vendor's key to their repository alone, and how to stop that repository replacing the rest of your system.