Command Line Common Structures

What command structure generates a 2048-bit RSA private key?

openssl genpkey -algorithm RSA -out <private_key_file> -pkeyopt rsa_keygen_bits:2048

What command extracts the public key from a private key?

openssl rsa -pubout -in <private_key_file> -out <public_key_file>

What command signs a file with a private key using SHA-256?

openssl dgst -sha256 -sign <private_key_file> -out <signature_file> <data_file>

What command verifies a file against its signature using the public key?

penssl dgst -sha256 -verify <public_key_file> -signature <signature_file> <data_file>

What command encrypts a file so only the private key holder can read it?

openssl pkeyutl -encrypt -pubin -inkey <public_key_file> -in <input_file> -out <encrypted_file>

What command decrypts a file using the private key?

openssl pkeyutl -decrypt -inkey <private_key_file> -in <encrypted_file> -out <decrypted_file>

What command creates a CSR to send to a Certificate Authority?

openssl req -new -key <private_key_file> -out <csr_file>

What command signs a CSR using a root CA certificate to issue a new cert?

openssl x509 -req -in <csr_file> -CA <ca_certificate> -CAkey <ca_private_key> -CAcreateserial -out <issued_cert> -days <days> -sha256

What command creates a self-signed root certificate (no CSR needed)?

openssl req -new -x509 -key <private_key> -out <root_certificate> -days <days>

How do you drop all packets coming from IP x?

iptables -A INPUT -s <x> -j DROP

How do you block all incoming SSH (port 22) traffic?

iptables -A INPUT -p tcp --dport 22 -j DROP

How do you accept all forwarded traffic coming in from eth0?

iptables -A FORWARD -i eth0 -j ACCEPT

How do you enable NAT so a private subnet can access the internet via eth0?

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

How do you forward all incoming traffic from eth0 to an internal server at 192.168.3.8?

iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 192.168.3.8

What does -i mean in iptables?

Input interface. It matches packets that are entering the machine through the specified network interface (e.g., eth0).

What does -o mean in iptables?

Output interface. It matches packets that are leaving the machine through the specified network interface.

What does -j mean in iptables?

It specifies the target action to take on a matching packet (e.g., ACCEPT, DROP, REJECT, LOG, MASQUERADE).

In iptables, what does the -s flag specify?

Source. It matches packets based on their source IP address or subnet.

In iptables, what does the -p flag specify?

Protocol. It matches packets based on the transport protocol (e.g., tcp, udp, icmp). Required before using --dport or --sport.

In iptables, what does the -t flag specify?

Table. It specifies which table to operate on (filter [default], nat, mangle). Without it, commands default to the filter table.

In iptables, what does the -d flag specify?

The -d option in iptables stands for Destination.