1
00:00:00,270 --> 00:00:01,200
In this lesson,

2
00:00:01,200 --> 00:00:02,430
you're going to learn how to search

3
00:00:02,430 --> 00:00:04,710
for more about the identities and activities

4
00:00:04,710 --> 00:00:06,810
of each account on your system.

5
00:00:06,810 --> 00:00:08,700
There are several ways to gather information

6
00:00:08,700 --> 00:00:10,980
about user accounts and group memberships

7
00:00:10,980 --> 00:00:11,940
that you might find useful

8
00:00:11,940 --> 00:00:14,160
for troubleshooting your access problems.

9
00:00:14,160 --> 00:00:16,680
In addition to this, there's multiple ways of identifying

10
00:00:16,680 --> 00:00:19,650
what users might currently be logged in to a system.

11
00:00:19,650 --> 00:00:21,600
By understanding how to run these commands,

12
00:00:21,600 --> 00:00:22,890
you're going to be able to answer questions

13
00:00:22,890 --> 00:00:24,720
that your users might have.

14
00:00:24,720 --> 00:00:26,160
The first command we're going to talk about

15
00:00:26,160 --> 00:00:27,810
is the whoami command.

16
00:00:27,810 --> 00:00:29,700
This is used to display the username

17
00:00:29,700 --> 00:00:32,040
with which you're currently logged in to a system.

18
00:00:32,040 --> 00:00:34,440
Sometimes, you may need to log in to a system

19
00:00:34,440 --> 00:00:36,240
and switch amongst different users,

20
00:00:36,240 --> 00:00:37,680
and you may not be sure anymore

21
00:00:37,680 --> 00:00:40,020
which user you're currently logged in as.

22
00:00:40,020 --> 00:00:42,810
When this occurs, just enter the whoami command,

23
00:00:42,810 --> 00:00:45,000
and you'll verify your current username.

24
00:00:45,000 --> 00:00:47,340
Many Linux distributions will show the username

25
00:00:47,340 --> 00:00:50,130
of the currently logged in user at your command prompt too,

26
00:00:50,130 --> 00:00:51,810
so you wouldn't even need to use this command,

27
00:00:51,810 --> 00:00:55,080
but a lot of them don't, and so whoami is really helpful.

28
00:00:55,080 --> 00:00:57,360
If you're logged in as the root user for example,

29
00:00:57,360 --> 00:00:59,070
you're going to see your command prompt turn

30
00:00:59,070 --> 00:01:01,470
into a hashtag or pound sign.

31
00:01:01,470 --> 00:01:03,330
If you're logged in as a standard user though,

32
00:01:03,330 --> 00:01:04,980
you're going to see a dollar sign character

33
00:01:04,980 --> 00:01:06,750
as your command prompt.

34
00:01:06,750 --> 00:01:09,210
The next command we have is the who command.

35
00:01:09,210 --> 00:01:11,850
Now, the who command is used to determine the details

36
00:01:11,850 --> 00:01:13,650
of the user who is currently logged in

37
00:01:13,650 --> 00:01:15,360
to a particular system.

38
00:01:15,360 --> 00:01:18,090
The output of the who command includes the username,

39
00:01:18,090 --> 00:01:20,490
the name of the system from which the user is connected,

40
00:01:20,490 --> 00:01:23,280
and the date and time the user's been connected since.

41
00:01:23,280 --> 00:01:25,770
The proper way for accessing this command and using it

42
00:01:25,770 --> 00:01:29,220
is by typing who and then the options at the command prompt.

43
00:01:29,220 --> 00:01:32,040
The -u option can be used to show how long users

44
00:01:32,040 --> 00:01:33,060
have been idle.

45
00:01:33,060 --> 00:01:34,710
This means how long have they been connected,

46
00:01:34,710 --> 00:01:36,420
but haven't been doing anything.

47
00:01:36,420 --> 00:01:38,010
Now, if you see dot here,

48
00:01:38,010 --> 00:01:41,220
this indicates the user was acted up until the last minute,

49
00:01:41,220 --> 00:01:43,710
if you see old here, this indicates the users

50
00:01:43,710 --> 00:01:46,140
have been inactive for over 24 hours,

51
00:01:46,140 --> 00:01:47,850
and anything in between two minutes

52
00:01:47,850 --> 00:01:49,860
and 23 hours and 59 minutes

53
00:01:49,860 --> 00:01:53,160
will show the exact length of time that they have been idle.

54
00:01:53,160 --> 00:01:57,210
Now, the am I option, entered as who am i,

55
00:01:57,210 --> 00:01:59,160
will display information only for the user

56
00:01:59,160 --> 00:02:00,870
who ran the command.

57
00:02:00,870 --> 00:02:03,990
Another command we have is simply known as w.

58
00:02:03,990 --> 00:02:06,870
The w command is primarily used to display the details

59
00:02:06,870 --> 00:02:09,210
of users who are currently logged in to a system

60
00:02:09,210 --> 00:02:11,310
and their associated transactions.

61
00:02:11,310 --> 00:02:13,230
The first line of the output displays the status

62
00:02:13,230 --> 00:02:14,220
of the system,

63
00:02:14,220 --> 00:02:16,290
the second line of the output displays a table

64
00:02:16,290 --> 00:02:18,240
with the first column listing the users logged in

65
00:02:18,240 --> 00:02:19,073
to the system,

66
00:02:19,073 --> 00:02:21,600
and the last column indicating the current activities

67
00:02:21,600 --> 00:02:22,860
of the users.

68
00:02:22,860 --> 00:02:24,570
The remaining columns of the table

69
00:02:24,570 --> 00:02:27,600
will show different attributes associated with the users.

70
00:02:27,600 --> 00:02:29,040
To use the w command,

71
00:02:29,040 --> 00:02:32,760
simply enter w, options, and the username.

72
00:02:32,760 --> 00:02:34,890
The last command is going to display the history

73
00:02:34,890 --> 00:02:37,290
of the user login and logout actions,

74
00:02:37,290 --> 00:02:39,450
along with the actual time and date.

75
00:02:39,450 --> 00:02:41,970
It also has options to enable you to filter users

76
00:02:41,970 --> 00:02:44,340
who've logged in through a specific terminal.

77
00:02:44,340 --> 00:02:47,280
For example, last 1 will display the details

78
00:02:47,280 --> 00:02:50,130
of users who logged in through the first terminal.

79
00:02:50,130 --> 00:02:52,320
The last command will retrieve information

80
00:02:52,320 --> 00:02:56,640
from the /var/log/wtmp file.

81
00:02:56,640 --> 00:02:58,350
You can access the last command

82
00:02:58,350 --> 00:03:00,930
by entering last and then options.

83
00:03:00,930 --> 00:03:02,730
If you're trying to figure out what commands

84
00:03:02,730 --> 00:03:04,590
were run recently on a given system,

85
00:03:04,590 --> 00:03:07,590
your last command is really going to be useful to you here,

86
00:03:07,590 --> 00:03:10,710
this is really helpful during instant responses too.

87
00:03:10,710 --> 00:03:12,720
The id command is our next one.

88
00:03:12,720 --> 00:03:16,500
The id command is used to display the user ID or UID

89
00:03:16,500 --> 00:03:20,340
and the group ID or GID for a given user.

90
00:03:20,340 --> 00:03:22,110
Entering the command with no options

91
00:03:22,110 --> 00:03:23,640
will display information about the user

92
00:03:23,640 --> 00:03:25,350
who is currently logged in.

93
00:03:25,350 --> 00:03:28,500
You could also specify a username as one of the options

94
00:03:28,500 --> 00:03:31,920
to display the ID information about a particular user.

95
00:03:31,920 --> 00:03:33,900
The proper way to use the id command

96
00:03:33,900 --> 00:03:36,693
is to enter id, the options, and the username.