CIS 218 Advanced UNIX 1 User and System Information CIS 218

CIS 218 Advanced UNIX 2 System resources v System resources: cpu, memory, disk, processes (32K or 64K)  Display CPU using: top  Display CPU/Memory using: vmstat  Display disk using: iostat or vmstat  Display disk using: ps –ef, ps aux, ps -aux

CIS 218 Advanced UNIX 3 File Systems  Separate areas on disks are placed under different directories called mountpoints  The are displayed with the mount command  Different areas can be formatted with different filesystem formats.  The are displayed with the df command

CIS 218 Advanced UNIX 4 /etc/passwd v The password file: root:jheVopR58x9Fx:0:1:The superuser:/:/bin/sh nobody:*:65534:65534::/: stevens:3hKVD8R58r9Fx:224:100: Richard Stevens:/home/stevens:/bin/ksh v Colon separates seven fields:userid, encrypted password, uid, gid, user info (finger), HOME –$ man passwd

CIS 218 Advanced UNIX 5 Special /etc/passwd values  root has the user ID 0 v “system” uids less than 100  nobody cannot login, but programs can run as nobody. nobody can only access world readable or writable files  / sbin/nologin used for “daemon” processes that don’t login but used to secure files and directories

CIS 218 Advanced UNIX 6 /etc/shadow  Passwords now stored in /etc/shadow  The password is encrypted using crypt() –one-way: there is no known way to decrypt (decode) a password  nobody cannot login, but programs can run as nobody. nobody can only access world readable or writable files

CIS 218 Advanced UNIX 7 /etc/shadow  /etc/shadow stores encrypted password strings –only readable by root. suid by login –/etc/passwd contains only ‘ x ’s in its password fields –In older systems pwconv pwconv converts to /etc/shadow usage  This prevents password cracking by copying /etc/passwd and then using ‘guess and test’ –many passwords are very simple unless newer system enforces password xcompleity rules.

CIS 218 Advanced UNIX 8 Finger  finger accesses the GECOS field: stevens:3hKVD8R58r9Fx:224:100: Richard &, B232, , : /home/stevens:/bin/ksh –different fields within GECOS are separated by commas: u user name, office, work and home phone numbers –& is replaced by the capitalised user name

CIS 218 Advanced UNIX 9 / etc/group v Lists every group on the system, an optional password, its group ID, and the users who are members: wheel:*:0:root, rachel uucp:*:10:uucp vision:AweHG67Ket4Ds:101:keith, arlin users:*:100: $ man group

CIS 218 Advanced UNIX 10 Joining Groups  /etc/group lists group users in addition to the ones who are members because of their /etc/passwd group ID. –e.g. stevens is in users because he has group ID 100  A user can change group with newgrp –usually must be a member of that group –some groups have passwords (e.g. vision )

CIS 218 Advanced UNIX 11 Supplementary Group IDs v In earlier UNIXs, each user belonged to one group at a time. –change was possible with newgrp v Current systems use same uid and gid by default for ordinary user ids v Some UNIXs now have supplementary group IDs: –a user can belong to up to 16 additional groups –no longer need to use newgrp (so much)

CIS 218 Advanced UNIX 12 v Keeps track of the network addresses for every host on the local network. v Often incomplete since the system can also ask address servers on other machines.  Typical /etc/hosts : localhost ratree.psu.ac.th ratree loghost ns.psu.ac.th ns ratree2.psu.ac.th ratree2 /etc/hosts

CIS 218 Advanced UNIX 13 /etc/protocols v Stores details about network protocols supported by the system.  Fragment of /etc/protocols : tcp 6 TCP # transmission control protocol : udp 17 UDP # user datagram protocol :

CIS 218 Advanced UNIX 14 /etc/services v Stores details on the network services supported by the system –built on top of network protocols  Fragment of /etc/services ftp21/tcp smtp25/tcpmail : irc194/tcp# internet relay chat irc194/udp :

CIS 218 Advanced UNIX 15 Login Accounting  /var/run/utmp –records which users are currently logged in –used by who, users, finger, ps –may be located in /var/adm/  /var/log/wtmp –records all logins, logouts, shutdowns, reboots –used by last –may be located in /var/adm/

CIS 218 Advanced UNIX 16 last (reboot)  Displays wtmp in an understandable form. v Lists all logins, logouts, etc. since file creation.  $ last | grep boot reboot System boot Fri Aug 15 22:15 reboot System boot Fri Aug 15 15:21 reboot System boot Fri Aug 4 17:24 reboot System boot Fri Aug 4 15:41 continued

CIS 218 Advanced UNIX 17 last (user)  $ last rich ttypbmit.usa Tue Aug 19 13:19 still logged in zonkttyp Tue Aug 19 13: :14 (00:02) rich ttypalisa.ac.thTue Aug 19 13:11 still logged in zonk ttyp3lennyTue Aug 19 12: :21 (00:14) :  $ last rich rich ttypbmit.usaTue Aug 19 13:19 still logged in rich ttypafoo.lisa.ac.th Tue Aug 19 13:11 still logged in rich ttyp0goo.lisa.ac.th Mon Aug 18 11: :45 (00:44) rich ftpmit.usaSat Aug 16 00: :04 (00:01)

CIS 218 Advanced UNIX 18 The System Log: syslog syslogd user process /dev/log UDP port 514 /dev/klog kernel routines Unix domain datagram socket Internet domain datagram socket TCP/IP network syslog() files, console or Kernel log() $ man syslogd

CIS 218 Advanced UNIX 19 Logging Messages  Any program can generate log messages using syslog(). v A log message includes: –the program name, a facility, a priority, and the message text v Example: login: Root LOGIN REFUSED on ttya –sent by an authorization facility ( login ); it is critical

CIS 218 Advanced UNIX 20 Some syslog Facilities  NameFacility kern The kernel. user Regular user processes. mail The mail system. lpr The printer system. : auth The authorization system, or programs that ask for user names and passwords (e.g. login, su, getty, ftp ).

CIS 218 Advanced UNIX 21 Some Syslog Priorities (levels)  PriorityMeaning emerg Emergency (e.g. crash). alert Fix immediately (e.g. bad db). crit Critical (e.g. hardware error). err Ordinary error. : notice Not an error, but important. : debug Debug messages.

CIS 218 Advanced UNIX 22 Other system info commands uptime system since last reboot w who. Lists users, login times, and status. finger Shows personal information. date Shows current date and time. man MANual pages. Complete online reference. ps ProceSses. Show programs are being run. top shows top users of CPU and RAM (see also ps -aux and vmstat) unameDisplay UNIX information iostatdevice utilization vmstatvirtual memory statistics sarsystem activity reporter iostat some systems, displays disk IO activity df (-v) display file system utilization df (-v) display file system utilization dudisplay directory utilization mount display file system mountpoints, type hostnamedisplay the hostname dmesgdisplay OS startup info ulimitsystem resource limits (see /etc/security/limits.conf)