System/Kernel
mark@node:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=04eca96c5bf3e9a300952a29ef3218f00487d37b, stripped
linux node 4.4.0-93-generic #116-ubuntu smp fri aug 11 21:17:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.3 LTS"
NAME="Ubuntu"
VERSION="16.04.3 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.3 LTS"
VERSION_ID="16.04"
home_url="http://www.ubuntu.com/"
support_url="http://help.ubuntu.com/"
bug_report_url="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial4.4.0-93-generic
Ubuntu 16.04.3 LTS (Xenial Xerus)
x86-64
Networks
mark@node:~$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 604 10.10.10.58:22 10.10.14.5:53550 ESTABLISHED -
tcp 0 0 127.0.0.1:60880 127.0.0.1:27017 ESTABLISHED -
tcp 0 0 10.10.10.58:22 10.10.14.5:40318 ESTABLISHED -
tcp 0 0 127.0.0.1:27017 127.0.0.1:60880 ESTABLISHED -
tcp 0 0 127.0.0.1:27017 127.0.0.1:60878 ESTABLISHED -
tcp 0 0 127.0.0.1:60878 127.0.0.1:27017 ESTABLISHED - 127.0.0.1:27017
127.0.0.1:60878
Users
mark@node:~$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
lxd:x:106:65534::/var/lib/lxd/:/bin/false
messagebus:x:107:111::/var/run/dbus:/bin/false
uuidd:x:108:112::/run/uuidd:/bin/false
dnsmasq:x:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
sshd:x:110:65534::/var/run/sshd:/usr/sbin/nologin
tom:x:1000:1000:tom,,,:/home/tom:/bin/bash
mongodb:x:111:65534::/home/mongodb:/bin/false
mark:x:1001:1001:Mark,,,:/home/mark:/bin/bash
total 20
drwxr-xr-x 5 root root 4096 Aug 31 2017 ./
drwxr-xr-x 25 root root 4096 aug 16 17:08 ../
drwxr-xr-x 2 root root 4096 Aug 31 2017 frank/
drwxr-xr-x 3 root root 4096 Sep 3 2017 mark/
drwxr-xr-x 6 root root 4096 aug 16 16:17 tom/frank
tom
SUIDs
mark@node:~$ find / -perm -04000 -ls -type f 2>/dev/null
6129 12 -rwsr-xr-x 1 root root 10232 Mar 27 2017 /usr/lib/eject/dmcrypt-get-device
51293 80 -rwsr-xr-x 1 root root 81672 Jul 17 2017 /usr/lib/snapd/snap-confine
13513 44 -rwsr-xr-- 1 root messagebus 42992 Jan 12 2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
14261 40 -rwsr-xr-x 1 root root 38984 Jun 14 2017 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
17884 420 -rwsr-xr-x 1 root root 428240 Mar 16 2017 /usr/lib/openssh/ssh-keysign
35964 16 -rwsr-xr-x 1 root root 14864 Jan 17 2016 /usr/lib/policykit-1/polkit-agent-helper-1
56747 20 -rwsr-xr-- 1 root admin 16484 Sep 3 2017 /usr/local/bin/backup
5806 52 -rwsr-xr-x 1 root root 49584 May 17 2017 /usr/bin/chfn
35020 52 -rwsr-sr-x 1 daemon daemon 51464 Jan 14 2016 /usr/bin/at
5869 76 -rwsr-xr-x 1 root root 75304 May 17 2017 /usr/bin/gpasswd
14308 36 -rwsr-xr-x 1 root root 32944 May 17 2017 /usr/bin/newgidmap
5808 40 -rwsr-xr-x 1 root root 40432 May 17 2017 /usr/bin/chsh
6028 136 -rwsr-xr-x 1 root root 136808 Jul 4 2017 /usr/bin/sudo
35972 24 -rwsr-xr-x 1 root root 23376 Jan 17 2016 /usr/bin/pkexec
5933 40 -rwsr-xr-x 1 root root 39904 May 17 2017 /usr/bin/newgrp
5944 56 -rwsr-xr-x 1 root root 54256 May 17 2017 /usr/bin/passwd
14307 36 -rwsr-xr-x 1 root root 32944 May 17 2017 /usr/bin/newuidmap
4124 44 -rwsr-xr-x 1 root root 44168 May 7 2014 /bin/ping
4159 28 -rwsr-xr-x 1 root root 27608 Jun 14 2017 /bin/umount
13946 32 -rwsr-xr-x 1 root root 30800 Jul 12 2016 /bin/fusermount
4125 44 -rwsr-xr-x 1 root root 44680 May 7 2014 /bin/ping6
13968 140 -rwsr-xr-x 1 root root 142032 Jan 28 2017 /bin/ntfs-3g
4141 40 -rwsr-xr-x 1 root root 40128 May 17 2017 /bin/su
4109 40 -rwsr-xr-x 1 root root 40152 Jun 14 2017 /bin/mount
/usr/local/bin/backup
/usr/bin/pkexec
SGIDs
mark@node:~$ find / -perm -02000 -ls -type f 2>/dev/null
333 0 drwxr-sr-x 3 root systemd-journal 60 jan 18 19:29 /run/log/journal
334 0 drwxr-s--- 2 root systemd-journal 100 jan 18 19:29 /run/log/journal/fcba75938402011ce0da463259a5e55e
5769 36 -rwxr-sr-x 1 root shadow 35600 Mar 16 2016 /sbin/unix_chkpwd
5733 36 -rwxr-sr-x 1 root shadow 35632 Mar 16 2016 /sbin/pam_extrausers_chkpwd
35078 12 -rwxr-sr-x 1 root utmp 10232 Mar 11 2016 /usr/lib/x86_64-linux-gnu/utempter/utempter
34269 4 drwxrwsr-x 4 root staff 4096 aug 16 17:08 /usr/local/lib/python2.7
34351 4 drwxrwsr-x 2 root staff 4096 Sep 2 2017 /usr/local/lib/python2.7/site-packages
34315 4 drwxrwsr-x 2 root staff 4096 Sep 2 2017 /usr/local/lib/python2.7/dist-packages
8780 4 drwxrwsr-x 3 root staff 4096 aug 16 17:08 /usr/local/lib/python3.5
8781 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/lib/python3.5/dist-packages
44304 4 drwxrwsr-x 6 root staff 4096 aug 16 17:08 /usr/local/share/xml
44308 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/xml/schema
44306 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/xml/declaration
44307 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/xml/entities
44305 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/xml/misc
37285 4 drwxrwsr-x 7 root staff 4096 aug 16 17:08 /usr/local/share/sgml
37287 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/sgml/stylesheet
37286 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/sgml/declaration
37290 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/sgml/dtd
37288 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/sgml/entities
37289 4 drwxrwsr-x 2 root staff 4096 aug 16 17:08 /usr/local/share/sgml/misc
5803 64 -rwxr-sr-x 1 root shadow 62336 May 17 2017 /usr/bin/chage
35020 52 -rwsr-sr-x 1 daemon daemon 51464 Jan 14 2016 /usr/bin/at
5854 24 -rwxr-sr-x 1 root shadow 22768 May 17 2017 /usr/bin/expiry
34634 352 -rwxr-sr-x 1 root ssh 358624 Mar 16 2017 /usr/bin/ssh-agent
34562 40 -rwxr-sr-x 1 root mlocate 39520 Nov 18 2014 /usr/bin/mlocate
35098 428 -rwxr-sr-x 1 root utmp 434216 Feb 7 2016 /usr/bin/screen
6081 28 -rwxr-sr-x 1 root tty 27368 Jun 14 2017 /usr/bin/wall
13822 16 -rwxr-sr-x 1 root tty 14752 Mar 1 2016 /usr/bin/bsd-write
5817 36 -rwxr-sr-x 1 root crontab 36080 Apr 5 2016 /usr/bin/crontab
130853 4 drwxrwsr-x 2 root mail 4096 Aug 1 2017 /var/mail
145630 4 drwxr-sr-x 2 man root 4096 aug 16 16:28 /var/cache/man
130837 4 drwxrwsr-x 2 root staff 4096 Apr 12 2016 /var/localProcesses
mark@node:~$ ps -aux | grep -i 'root' --color=auto
root 1 0.0 0.7 37872 5924 ? Ss 19:29 0:02 /sbin/init
root 490 0.0 0.3 28032 2964 ? Ss 19:29 0:00 /lib/systemd/systemd-journald
root 513 0.0 0.2 102968 1668 ? Ss 19:29 0:00 /sbin/lvmetad -f
root 527 0.0 0.4 44356 3764 ? Ss 19:29 0:00 /lib/systemd/systemd-udevd
root 1040 0.0 0.4 28548 3200 ? Ss 19:29 0:00 /lib/systemd/systemd-logind
root 1042 0.0 0.7 275892 5824 ? Ssl 19:29 0:00 /usr/lib/accountsservice/accounts-daemon
root 1044 0.0 1.2 192268 9648 ? Ssl 19:29 0:09 /usr/bin/vmtoolsd
root 1045 0.0 0.4 621768 3788 ? Ssl 19:29 0:00 /usr/bin/lxcfs /var/lib/lxcfs/
root 1053 0.0 0.1 4400 1292 ? Ss 19:29 0:00 /usr/sbin/acpid
root 1059 0.0 3.2 342116 24356 ? S<sl 19:29 0:00 /usr/lib/snapd/snapd
root 1067 0.0 0.3 29008 2424 ? Ss 19:29 0:00 /usr/sbin/cron -f
root 1133 0.0 0.7 277180 6016 ? Ssl 19:29 0:00 /usr/lib/policykit-1/polkitd --no-debug
root 1146 0.0 0.0 13376 152 ? Ss 19:29 0:00 /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog
root 1227 0.0 0.7 65520 6028 ? Ss 19:29 0:00 /usr/sbin/sshd -D
root 1252 0.0 0.0 5224 140 ? Ss 19:29 0:00 /sbin/iscsid
root 1253 0.0 0.4 5724 3520 ? S<Ls 19:29 0:01 /sbin/iscsid
root 1316 0.0 0.2 15940 1584 tty1 Ss+ 19:29 0:00 /sbin/agetty --noclear tty1 linux
root 1522 0.0 0.9 95404 6980 ? Ss 22:29 0:00 sshd: mark [priv]
root 1552 0.0 0.9 95404 6832 ? Ss 22:52 0:00 sshd: mark [priv]
mark 1608 0.0 0.1 11284 1012 pts/1 S+ 23:00 0:00 grep --color=auto -i root --color=auto/usr/sbin/cron -f
/usr/lib/policykit-1/polkitd --no-debug
Cron & Systemd
mark@node:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers --all
no crontab for mark
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED UNIT ACTIVATES
thu 2023-01-19 06:28:06 GMT 7h left Wed 2023-01-18 19:29:39 GMT 3h 32min ago apt-daily-upgrade.timer apt-daily-upgrade.servic
thu 2023-01-19 16:35:34 GMT 17h left Wed 2023-01-18 19:29:39 GMT 3h 32min ago apt-daily.timer apt-daily.service
thu 2023-01-19 19:44:37 GMT 20h left Wed 2023-01-18 19:44:37 GMT 3h 17min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.s
mon 2023-01-23 02:31:35 GMT 4 days left Wed 2023-01-18 21:09:18 GMT 1h 52min ago snapd.refresh.timer snapd.refresh.service
n/a n/a n/a n/a ureadahead-stop.timer ureadahead-stop.service
5 timers listed.Sudo Version
mark@node:~$ sudo -V
Sudo version 1.8.16
Sudoers policy plugin version 1.8.16
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.16
Sudo version 1.8.16
Glibc Version
mark@node:~$ ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu9) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.23-0ubuntu9) 2.23