Where Settings Live

Windows keeps settings in the registry and policy editors. Linux keeps them in text files, almost all under /etc, and in a few live kernel interfaces. If you know which file owns a setting, you can read it, change it, and prove it changed.

The files you'll touch most

Setting	File	Read it back with
Accounts	/etc/passwd, /etc/shadow, /etc/group	getent passwd, sudo getent shadow user, getent group sudo
Password aging defaults	/etc/login.defs	grep -E '^PASS_' /etc/login.defs
Password quality	/etc/security/pwquality.conf	grep -E '^(minlen|dcredit)' /etc/security/pwquality.conf
Login lockout	/etc/security/faillock.conf	grep -E '^(deny|unlock_time|fail_interval)' /etc/security/faillock.conf
How logins are checked (PAM)	/etc/pam.d/common-auth, common-password, common-account	cat /etc/pam.d/common-auth
Who can use sudo	/etc/sudoers, /etc/sudoers.d/*	sudo grep -r . /etc/sudoers /etc/sudoers.d
SSH server	/etc/ssh/sshd_config, /etc/ssh/sshd_config.d/*	sudo sshd -T | grep -i permitrootlogin
Kernel modules to block	/etc/modprobe.d/*.conf	modprobe -n -v usb-storage
AppArmor	/etc/apparmor.d/*	sudo aa-status
Login banners	/etc/issue, /etc/issue.net, /etc/motd	cat /etc/issue
Firewall	ufw command, rules in /etc/ufw/user.rules	sudo ufw status verbose
Kernel settings	/etc/sysctl.conf, /etc/sysctl.d/*.conf; live values in /proc/sys	sysctl net.ipv4.ip_forward
Services	systemd units	systemctl status name, systemctl is-enabled name
Mounts	/etc/fstab	findmnt /dev/shm
Bootloader	/etc/grub.d/*, /etc/default/grub; generated /boot/grub/grub.cfg	sudo grep password /boot/grub/grub.cfg
Package sources	Mint: /etc/apt/sources.list.d/official-package-repositories.list; Debian: /etc/apt/sources.list	apt policy
Desktop lock and login screen	gsettings; Mint: /etc/lightdm/lightdm.conf; Debian: /etc/gdm3/*	gsettings get org.cinnamon.desktop.screensaver lock-enabled (Mint)
Journal	/etc/systemd/journald.conf, journald.conf.d/*	journalctl --disk-usage

Reading a value back

Every page on this site has a Verify block, and most of them are grep. The pattern to learn:

grep -E '^PASS_MAX_DAYS' /etc/login.defs

^ anchors to the start of the line, so a commented-out # PASS_MAX_DAYS doesn't match. That distinction matters everywhere on Linux: a line starting with # is a comment and does nothing, and half the "settings" on an untouched image are comments showing the default.

For settings that can come from several files (sshd_config.d, sysctl.d, sudoers.d), ask the program what it actually loaded rather than reading one file:

sudo sshd -T | grep -iE 'permitrootlogin|passwordauthentication'
sysctl -a 2>/dev/null | grep accept_redirects
sudo visudo -c

Making a change stick

Editing a file in /etc needs sudo. sudo nano /etc/login.defs is the simplest way; Ctrl+O then Enter saves, Ctrl+X exits. For one-line changes, sed from the command line is faster and appears on most pages here:

sudo sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 90/' /etc/login.defs

After a change, the thing that reads the file usually has to be told:

Changed	Then run
sshd_config	sudo systemctl restart ssh
sysctl.conf or sysctl.d	sudo sysctl --system
/etc/grub.d or /etc/default/grub	sudo update-grub
fstab	sudo mount -o remount /dev/shm or reboot
PAM, login.defs, faillock.conf, pwquality.conf, sudoers	Nothing; read on next use (but see the note on pam-auth-update on the faillock page)
/etc/modprobe.d	sudo modprobe -r module now; the block is permanent
journald.conf	sudo systemctl restart systemd-journald
ufw rules	Nothing; ufw applies immediately
Apache, nginx, MySQL, PostgreSQL, vsftpd, Samba config	sudo systemctl restart <service>

Try it

1. Pick three rows of the table, read the file, then read the value back with the command in the third column.
2. Change one setting with nano, then with sed -i, and compare how long each took.

Build it

A baseline.sh that runs the read-back command from every row of the table and saves the output to one file. Run it first thing on every image; everything else compares against it.

Next

Mint and Debian Differences