System/Kernel
www-data@zipper:/var/www/html$ uname -a ; cat /etc/*release
Linux zipper 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"
NAME="Ubuntu"
VERSION="20.04.2 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.2 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal5.4.0-90-genericx86_64Ubuntu 20.04.2 LTS (Focal Fossa)
Networks
www-data@zipper:/var/www/html$ ip route ; arp -a
default via 192.168.201.254 dev ens160 proto static
192.168.201.0/24 dev ens160 proto kernel scope link src 192.168.201.229
_gateway (192.168.201.254) at 00:50:56:9e:df:ab [ether] on ens160www-data@zipper:/var/www/html$ netstat -antup
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 16 192.168.201.229:47868 192.168.45.249:9999 ESTABLISHED 3784/sh
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 192.168.201.229:80 192.168.45.249:54086 ESTABLISHED -
udp 0 0 127.0.0.53:53 0.0.0.0:* - Users & Groups
www-data@zipper:/var/www/html$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
total 8.0K
4.0K drwxr-xr-x 20 root root 4.0K Aug 12 2021 ..
4.0K drwxr-xr-x 2 root root 4.0K Jan 7 2021 .www-data@zipper:/var/www/html$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(systemd-timesync) gid=104(systemd-timesync) groups=104(systemd-timesync)
uid=103(messagebus) gid=106(messagebus) groups=106(messagebus)
uid=104(syslog) gid=110(syslog) groups=110(syslog),4(adm),5(tty)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(tss) gid=111(tss) groups=111(tss)
uid=107(uuidd) gid=112(uuidd) groups=112(uuidd)
uid=108(tcpdump) gid=113(tcpdump) groups=113(tcpdump)
uid=109(landscape) gid=115(landscape) groups=115(landscape)
uid=110(pollinate) gid=1(daemon) groups=1(daemon)
uid=111(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=998(lxd) gid=100(users) groups=100(users)
uid=112(usbmux) gid=46(plugdev) groups=46(plugdev)SUIDs
www-data@zipper:/var/www/html$ find / -perm -04000 -ls -type f 2>/dev/null | grep -v '/snap'
1365 52 -rwsr-xr-- 1 root messagebus 51344 Jun 11 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
2386 464 -rwsr-xr-x 1 root root 473576 Jul 23 2021 /usr/lib/openssh/ssh-keysign
11577 24 -rwsr-xr-x 1 root root 22840 May 26 2021 /usr/lib/policykit-1/polkit-agent-helper-1
1372 16 -rwsr-xr-x 1 root root 14488 Jul 8 2019 /usr/lib/eject/dmcrypt-get-device
1956 84 -rwsr-xr-x 1 root root 85064 Jul 14 2021 /usr/bin/chfn
840 40 -rwsr-xr-x 1 root root 39144 Jul 21 2020 /usr/bin/umount
166 56 -rwsr-xr-x 1 root root 55528 Jul 21 2020 /usr/bin/mount
11395 164 -rwsr-xr-x 1 root root 166056 Jan 19 2021 /usr/bin/sudo
11575 32 -rwsr-xr-x 1 root root 31032 May 26 2021 /usr/bin/pkexec
1966 68 -rwsr-xr-x 1 root root 68208 Jul 14 2021 /usr/bin/passwd
7536 44 -rwsr-xr-x 1 root root 44784 Jul 14 2021 /usr/bin/newgrp
7658 68 -rwsr-xr-x 1 root root 67816 Jul 21 2020 /usr/bin/su
667 40 -rwsr-xr-x 1 root root 39144 Mar 7 2020 /usr/bin/fusermount
1962 88 -rwsr-xr-x 1 root root 88464 Jul 14 2021 /usr/bin/gpasswd
488 56 -rwsr-sr-x 1 daemon daemon 55560 Nov 12 2018 /usr/bin/at
1958 52 -rwsr-xr-x 1 root root 53040 Jul 14 2021 /usr/bin/chshSGIDs
www-data@zipper:/var/www/html$ find / -perm -02000 -ls -type f 2>/dev/null | grep -v '/snap'
12049 4 drwxr-sr-x 3 root systemd-journal 4096 Jan 7 2021 /var/log/journal
524863 4 drwxr-sr-x 2 root systemd-journal 4096 Apr 6 12:54 /var/log/journal/b266781b406945aeb7b9b987494ac6b1
11741 4 drwxrwsr-x 2 root mail 4096 Jul 31 2020 /var/mail
11739 4 drwxrwsr-x 2 root staff 4096 Apr 15 2020 /var/local
325 0 drwxr-sr-x 2 root systemd-journal 40 Aug 3 2024 /run/log/journal
661 44 -rwxr-sr-x 1 root shadow 43160 Apr 8 2021 /usr/sbin/unix_chkpwd
625 44 -rwxr-sr-x 1 root shadow 43168 Apr 8 2021 /usr/sbin/pam_extrausers_chkpwd
134101 16 -rwxr-sr-x 1 root utmp 14648 Sep 30 2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
2356 344 -rwxr-sr-x 1 root ssh 350504 Jul 23 2021 /usr/bin/ssh-agent
3432 16 -rwxr-sr-x 1 root mail 14488 Aug 26 2019 /usr/bin/mlock
586 44 -rwxr-sr-x 1 root crontab 43720 Feb 13 2020 /usr/bin/crontab
3339 36 -rwxr-sr-x 1 root tty 35048 Jul 21 2020 /usr/bin/wall
1953 84 -rwxr-sr-x 1 root shadow 84512 Jul 14 2021 /usr/bin/chage
488 56 -rwsr-sr-x 1 daemon daemon 55560 Nov 12 2018 /usr/bin/at
1960 32 -rwxr-sr-x 1 root shadow 31312 Jul 14 2021 /usr/bin/expiry
501 16 -rwxr-sr-x 1 root tty 14488 Mar 30 2020 /usr/bin/bsd-write
271768 4 drwxrwsr-x 2 root staff 4096 Aug 12 2021 /usr/local/share/fonts
8380 4 drwxrwsr-x 3 root staff 4096 Jul 31 2020 /usr/local/lib/python3.8
8381 4 drwxrwsr-x 2 root staff 4096 Jul 31 2020 /usr/local/lib/python3.8/dist-packagesCapabilities
www-data@zipper:/var/www/html$ getcap -r / 2>/dev/null
/snap/core20/1169/usr/bin/ping = cap_net_raw+ep
/snap/core20/1242/usr/bin/ping = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/ping = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+epProcesses
www-data@zipper:/var/www/html$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.6 104692 12680 ? Ss 12:52 0:01 /sbin/init maybe-ubiquity
root 468 0.0 0.8 51476 17696 ? S<s 12:52 0:00 /lib/systemd/systemd-journald
root 496 0.0 0.3 22628 6800 ? Ss 12:52 0:00 /lib/systemd/systemd-udevd
root 636 0.0 0.8 345772 17992 ? SLsl 12:52 0:00 /sbin/multipathd -d -s
systemd+ 677 0.0 0.3 90228 6124 ? Ssl 12:52 0:00 /lib/systemd/systemd-timesyncd
root 688 0.0 0.5 47540 10536 ? Ss 12:52 0:00 /usr/bin/VGAuthService
root 689 0.0 0.3 163408 7880 ? Ssl 12:52 0:02 /usr/bin/vmtoolsd
systemd+ 763 0.0 0.5 23896 11964 ? Ss 12:52 0:00 /lib/systemd/systemd-resolved
root 847 0.0 0.3 235552 7312 ? Ssl 12:54 0:00 /usr/lib/accountsservice/accounts-daemon
root 852 0.0 0.1 6812 3052 ? Ss 12:54 0:00 /usr/sbin/cron -f
message+ 853 0.0 0.2 7640 4608 ? Ss 12:54 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 860 0.0 0.8 29012 18028 ? Ss 12:54 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
syslog 863 0.0 0.2 224348 5148 ? Ssl 12:54 0:00 /usr/sbin/rsyslogd -n -iNONE
root 865 0.2 1.6 644592 34212 ? Ssl 12:54 0:09 /usr/lib/snapd/snapd
root 867 0.0 0.3 16568 7652 ? Ss 12:54 0:00 /lib/systemd/systemd-logind
root 869 0.0 0.5 392552 12108 ? Ssl 12:54 0:00 /usr/lib/udisks2/udisksd
daemon 876 0.0 0.1 3792 2264 ? Ss 12:54 0:00 /usr/sbin/atd -f
root 887 0.0 0.0 5828 1796 tty1 Ss+ 12:54 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 930 0.0 0.3 12176 7404 ? Ss 12:54 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 931 0.0 0.3 232716 6920 ? Ssl 12:54 0:00 /usr/lib/policykit-1/polkitd --no-debug
root 960 0.0 1.0 107908 20728 ? Ssl 12:54 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root 963 0.0 1.5 225632 31088 ? Ss 12:54 0:00 /usr/sbin/apache2 -k start
root 1235 0.0 1.4 456028 29284 ? Ssl 12:54 0:00 /usr/libexec/fwupd/fwupd
root 1292 0.0 0.4 241220 8880 ? Ssl 12:54 0:00 /usr/lib/upower/upowerd
systemd+ 1490 0.0 0.3 18408 6148 ? Ss 12:54 0:00 /lib/systemd/systemd-networkd
www-data 1972 0.0 0.9 226112 18756 ? S 13:01 0:00 /usr/sbin/apache2 -k start
www-data 2431 0.0 1.7 240676 34968 ? S 13:13 0:00 /usr/sbin/apache2 -k start
www-data 2437 0.0 0.8 226112 17348 ? S 13:13 0:00 /usr/sbin/apache2 -k start
www-data 2443 0.0 2.4 256832 50528 ? S 13:13 0:00 /usr/sbin/apache2 -k start
www-data 2445 0.0 0.8 226368 18268 ? S 13:13 0:00 /usr/sbin/apache2 -k start
www-data 2473 0.0 0.9 226368 18492 ? S 13:13 0:00 /usr/sbin/apache2 -k start
www-data 2532 17.6 1.0 226368 20528 ? R 13:14 8:16 /usr/sbin/apache2 -k start
www-data 2543 0.0 0.8 226112 17404 ? S 13:14 0:00 /usr/sbin/apache2 -k start
www-data 2554 0.0 1.7 240704 35044 ? S 13:14 0:00 /usr/sbin/apache2 -k start
www-data 2566 0.0 0.8 226368 17344 ? S 13:15 0:00 /usr/sbin/apache2 -k start
www-data 3784 0.0 0.0 2608 608 ? S 13:52 0:00 sh -c bash
www-data 3785 0.0 0.1 3976 3060 ? S 13:52 0:00 bash
www-data 3959 0.0 0.4 15960 9476 ? S 13:58 0:00 python3 -c import pty; pty.spawn("/bin/bash")
www-data 3960 0.0 0.1 7440 3852 pts/0 Ss 13:58 0:00 /bin/bash
www-data 4119 0.0 0.1 9276 3376 pts/0 R+ 14:01 0:00 ps -auxwwwroot 852 0.0 0.1 6812 3052 ? Ss 12:54 0:00 /usr/sbin/cron -froot 931 0.0 0.3 232716 6920 ? Ssl 12:54 0:00 /usr/lib/policykit-1/polkitd --no-debugroot 1235 0.0 1.4 456028 29284 ? Ssl 12:54 0:00 /usr/libexec/fwupd/fwupd
Cron & Systemd
www-data@zipper:/var/www/html$ crontab -l ; cat /etc/crontab ; systemctl list-timers
crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root bash /opt/backup.sh
#
NEXT LEFT LAST PASSED >
Sun 2025-04-06 14:09:00 UTC 6min left Sun 2025-04-06 13:39:07 UTC 23min ago>
Sun 2025-04-06 15:47:31 UTC 1h 45min left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 00:00:00 UTC 9h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 00:00:00 UTC 9h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 00:00:00 UTC 9h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 03:50:30 UTC 13h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 04:07:51 UTC 14h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 04:25:24 UTC 14h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 06:52:33 UTC 16h left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
Mon 2025-04-07 13:07:41 UTC 23h left Sun 2025-04-06 13:07:41 UTC 54min ago>
Sun 2025-04-13 03:10:58 UTC 6 days left Sun 2025-04-06 12:54:26 UTC 1h 7min a>
11 timers listed.
Pass --all to see loaded but inactive timers, too.* * * * * root bash /opt/backup.sh
Services
www-data@zipper:/var/www/html$ systemctl list-units --state=running
UNIT LOAD ACTIVE SUB DESCRIPTION >
proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable >
init.scope loaded active running System and Service Ma>
accounts-daemon.service loaded active running Accounts Service >
apache2.service loaded active running The Apache HTTP Serve>
atd.service loaded active running Deferred execution sc>
cron.service loaded active running Regular background pr>
dbus.service loaded active running D-Bus System Message >
fwupd.service loaded active running Firmware update daemo>
getty@tty1.service loaded active running Getty on tty1 >
multipathd.service loaded active running Device-Mapper Multipa>
networkd-dispatcher.service loaded active running Dispatcher daemon for>
open-vm-tools.service loaded active running Service for virtual m>
polkit.service loaded active running Authorization Manager>
rsyslog.service loaded active running System Logging Servic>
snapd.service loaded active running Snap Daemon >
ssh.service loaded active running OpenBSD Secure Shell >
systemd-journald.service loaded active running Journal Service >
systemd-logind.service loaded active running Login Service >
systemd-networkd.service loaded active running Network Service >
systemd-resolved.service loaded active running Network Name Resoluti>
systemd-timesyncd.service loaded active running Network Time Synchron>
systemd-udevd.service loaded active running udev Kernel Device Ma>
udisks2.service loaded active running Disk Manager >
unattended-upgrades.service loaded active running Unattended Upgrades S>
upower.service loaded active running Daemon for power mana>
vgauth.service loaded active running Authentication servic>
dbus.socket loaded active running D-Bus System Message >
multipathd.socket loaded active running multipathd control so>
snapd.socket loaded active running Socket activation for>
syslog.socket loaded active running Syslog Socket >
systemd-journald-audit.socket loaded active running Journal Audit Socket >
systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/>
systemd-journald.socket loaded active running Journal Socket >
systemd-networkd.socket loaded active running Network Service Netli>
systemd-udevd-control.socket loaded active running udev Control Socket >
systemd-udevd-kernel.socket loaded active running udev Kernel Socket >
LOAD = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB = The low-level unit activation state, values depend on unit type.
36 loaded units listed.apache2.service
Sudo Version
www-data@zipper:/var/www/html$ sudo --version
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31Sudo version 1.8.31
Glibc Version
www-data@zipper:/var/www/html$ ldd --version
ldd (Ubuntu GLIBC 2.31-0ubuntu9.2) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.31-0ubuntu9.2) 2.31