19

You log in to an unfamiliar UNIX or Linux system (as root). Which commands do you run to orient yourself and figure out what kind of system you are on? How do you figure out what type of hardware is in use, which type of operating system is running and what the current situation is when it comes to permissions and security?

What is the first and second command you type?

closed as too broad by muru, slm Oct 2 '15 at 21:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I would use uname -a then apropos whatever is your friend. – fd0 Oct 1 '15 at 18:30
  • 1
    nmap -A -T4 localhost could also give you some useful info – seumasmac Oct 2 '15 at 1:03
  • @seumasmac netstat would be better and more efficient than nmapping the local machine. – André Borie Oct 2 '15 at 6:59
  • @AndréBorie nmap and netstat produce quite different results. Therefore it doesn't make much sense to compare them with respect to efficiency (whatever kind of). – moooeeeep Oct 2 '15 at 11:00
  • @AndréBorie I'd originally planned on putting a :) on the end of that. I'd been checking security on one of my own machines, and while holding my nmap hammer localhost suddenly looked like a nail. But then I realised it actually does give some interesting information, so I left it as a semi-serious suggestion. – seumasmac Oct 2 '15 at 21:12
22

a dual-use question! Either a Software Archaeologist or an Evil Hacker could use the answers to this question! Now, which am I?

I always used to use ps -ef versus ps -augxww to find out what I was on. Linux and System V boxes tended to like "-ef" and error on "-augxww", vice versa for BSD and old SunOS machines. The output of ps can let you know a lot as well.

If you can log in as root, and it's a Linux machine, you should do lsusb and lspci - that will get you 80% of the way towards knowing what the hardware situation is. dmesg | more can help you understand any current problems on just about anything.

It's beginning to be phased out, but doing ifconfig -a can usually tell you a lot about the network interfaces, and the networking. Running mii-tool and/or ethtool on the interfaces you see in ifconfig output that look like cabled ethernet can give you some info too.

Runnin ip route or netstat -r can be informative about Internet Protocol routing, and maybe something about in-use network interfaces.

A mount invocation can tell you about the disk(s) and how they're mounted.

Running uptime, and then last | more can tell you something about the current state of maintenance. Uptimes of 100+ days probably means "it's time to change the oil and fluids", metaphorically speaking. Running who is also

Looking at /etc/resolv.conf and /etc/hosts can tell you about the DNS setup of that machine. Maybe do nslookup google.com or dig bing.com to see if DNS is mostly functional.

It's always worth watching what errors ("command not found") and what variants of commands ("ps -ef" vs "ps augxww") work to determine what variant of Unix or Linux or BSD you just ended up on.

The presence or absence of a C compiler, and where it lives is important. Do which cc or better, which -a cc to find them.

  • I prefer netstat -tulpanw for more output but it is a matter of taste really. – Ned64 Oct 2 '15 at 16:24
  • There is also lshw under Linux. – Shahbaz Oct 2 '15 at 16:32
  • mount is messy, findmnt is very clean instead. – edmz Oct 2 '15 at 17:50
10

cat /etc/*release* is a nice command for getting an overview of which distro is running.

9

http://bhami.com/rosetta.html might be handy to review, otherwise I usually poke around under /etc (accounts, init stuff, hints of OS flavor, etc) and crontab -l and look through the ps list for things to learn about.

Also "as root" is super scary, as I've had to fix systems where a Linux admin doing such an investigation set all the Solaris hostnames to -f.

Also df is a dangerous command, a great way to oh whoops hung on blocking I/O. So never run that until you've at least investigated the mounts, or know you can get another session open somehow.

Use very simple commands (uname, cd /etc; ls, cat, $PAGER) until you figure out what the host is, and if you're unfamiliar with it, check a rosetta or always read the man page before assuming some command or flag to a command does what it does on more popular systems.

  • Makes me wonder: is there a robust way of (temporarily) dropping into a lower-privileged environment? Or is this not feasible or somehow not a good idea? – Oliphaunt Oct 2 '15 at 11:56
  • 1
    Why is df dangerous? Are there systems where it does something other than show filesystem usage? – terdon Oct 2 '15 at 18:14
  • 1
    @terdon kernel I/O blocking, e.g. on a hard NFS mount that's down; at best you can get a new session or terminal open somehow (time wasted during an outage), or at worst that was your only console onto that old Solaris system and uh yeah... maybe it will boot, maybe it won't, shame the mount information wasn't looked at first and that problematic NFS server line recognized... – thrig Oct 2 '15 at 18:43
  • 1
    If df hangs then you just CTRL-Z it and kill -9 it. I've ran into that problem as well and that's always worked for me. Also, ideally your mounts shouldn't be hung. I also don't think many people think of programs hanging as "dangerous" which is why I think terdon was confused. – Bratchley Oct 2 '15 at 18:49
  • 3
    @Bratchley oh, never had a console connection you can't send control characters over? Um where was that zmodem manual, or oh geez how do we sent them through the buggy Java thing to that other buggy thing ah geez who has physical access? – thrig Oct 2 '15 at 19:07
5

dmidecode and lspci will usually give you a good idea of what the hardware running on the system is. If this is a server usually running netstat -tlpn will give away the purpose of the server. df -hP is a good command for checking the current storage on the system. lsb_release -a should let you know what distro you're on:

[root@vle02 ~]# lsb_release -a
LSB Version:    :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 6.7 (Santiago)
Release:        6.7
Codename:       Santiago

Running last should let you know who uses the system. Assuming you've accessed this server legitimately, often you can just ask one of the people who log into it for more information about it.

For vendor neutral security checks: Often times the firewall will have unique configuration data so running a iptables -nvL is useful. You should also check out your distro's pam configuration files to see if you're only using local users or if you're configured to use ldap/kerberos/winbind/sssd/whatever.

You could also inspect the configuration of the services that come up in your netstat -tlpn. For instance, if you see apache, you can look at /etc/http/conf/httpd.conf (on RHEL, /etc/apache2 on Ubuntu) and try to see what websites are running. Alternatively you might do a apachectl -S to get a list of all the virtual hosts configured. It kind of fans out from there so all I can really do is offer apache as an example and just say to verify the daemon's configuration if it's something else.

On RHEL I would also check rpm -qa --last | head to see when the last time they did system updates. I would also check to see if SELinux is enabled via getenforce

0

A few other ideas:

  • Presence or absence of /proc filesystem may indicate if you're on Mac, FreeBSD, or Linux.
  • Package management differs from Linux distro to distro. Debian-based ones have apt, such as Deepin, Ubuntu, Mint; Red Hat and Fedora had yum up to some point but now Fedora has DNF; Arch uses pacman. So we could do something like this: ls /usr/bin | grep 'apt\|yum\|pacman'
  • Presence of certain services on certain ports when viewing netstat -tulpan. The could be sshd , webserver, ftp;
  • Note that the presence of a given executable on the system doesn't really mean anything. Debian, for example, has a yum package. How would the presence of an ssh server indicate the system? AFAIK you can find sshd on pretty much anything. – terdon Oct 2 '15 at 19:24
  • @terdon True. I'm just approaching this from the point of view of a new sysadmin where you get told "We have some Linux box overthere, go do something about it". At that point you may be asking , well: Does it have remote access ? Is that remote access hardened ? Does it has package management I am familiar with or do I have to learn new package manager ? The goal isn't necessarily determining what OS you get, Bruce Ediger already covered that, but I'm focusing more on investigating the system itself – Sergiy Kolodyazhnyy Oct 2 '15 at 19:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.