1
00:00:00,000 --> 00:00:00,960
Today I'ma walk you through

2
00:00:00,960 --> 00:00:04,019
how to query users and group accounts.

3
00:00:04,019 --> 00:00:05,910
Once we've created a user and group account,

4
00:00:05,910 --> 00:00:07,260
we're going to typically want to know

5
00:00:07,260 --> 00:00:09,300
how these accounts are being used.

6
00:00:09,300 --> 00:00:11,040
We're also going to want to track activities

7
00:00:11,040 --> 00:00:13,080
at times to ensure these accounts are being used

8
00:00:13,080 --> 00:00:14,580
for their intended purposes.

9
00:00:14,580 --> 00:00:15,930
So, the first command we're going to check

10
00:00:15,930 --> 00:00:17,330
out is the "whoami" command.

11
00:00:19,560 --> 00:00:22,050
Now you see the whoami is very simple.

12
00:00:22,050 --> 00:00:24,750
You type in whoami and it displays the current user

13
00:00:24,750 --> 00:00:26,130
that you are.

14
00:00:26,130 --> 00:00:27,570
Because typically what happens is,

15
00:00:27,570 --> 00:00:29,580
as an administrator we might switch

16
00:00:29,580 --> 00:00:32,910
from account to account and sometimes we can get lost

17
00:00:32,910 --> 00:00:34,140
in the shuffle.

18
00:00:34,140 --> 00:00:35,790
So the whoami is a quick way to see

19
00:00:35,790 --> 00:00:37,890
which user we're currently logged in with.

20
00:00:37,890 --> 00:00:39,180
Now we're just going to

21
00:00:39,180 --> 00:00:40,470
practice a little bit.

22
00:00:40,470 --> 00:00:43,500
Remember if you do substitute user

23
00:00:43,500 --> 00:00:44,333
with just a dash,

24
00:00:44,333 --> 00:00:46,230
it assumes you mean root.

25
00:00:46,230 --> 00:00:47,823
Type in the root password.

26
00:00:49,383 --> 00:00:51,300
"whoami" again.

27
00:00:51,300 --> 00:00:52,920
Now we can see we're currently logged in

28
00:00:52,920 --> 00:00:53,883
as the root.

29
00:00:54,810 --> 00:00:55,890
The next command we're going to go over

30
00:00:55,890 --> 00:00:57,690
is the "id" command.

31
00:00:57,690 --> 00:01:00,900
This simply just shows us our User ID,

32
00:01:00,900 --> 00:01:03,000
also a Group ID and the groups

33
00:01:03,000 --> 00:01:05,099
that we are associated with.

34
00:01:05,099 --> 00:01:06,540
Now currently,

35
00:01:06,540 --> 00:01:09,090
the groups that root is associated with isn't many.

36
00:01:09,090 --> 00:01:12,153
So if we just switch back to me J Kelly,

37
00:01:13,350 --> 00:01:17,040
we'll see that I'm associated with multiple groups.

38
00:01:17,040 --> 00:01:18,810
You can also use the "id"

39
00:01:18,810 --> 00:01:20,280
specifically for another user.

40
00:01:20,280 --> 00:01:22,710
It doesn't have to be who you are.

41
00:01:22,710 --> 00:01:25,770
So for example I use "id" for "ariley".

42
00:01:25,770 --> 00:01:28,863
Let's do "id" for "rstanley" oh there's no "rstanley"

43
00:01:32,850 --> 00:01:35,580
Let's see what other users we have in our queue.

44
00:01:35,580 --> 00:01:38,220
I'm going to go again "etc" "cat".

45
00:01:38,220 --> 00:01:39,813
See which ones we can look up.

46
00:01:41,137 --> 00:01:43,260
"cmason" let's try that one.

47
00:01:43,260 --> 00:01:44,583
Another ID with C.

48
00:01:46,380 --> 00:01:47,910
See their information there.

49
00:01:47,910 --> 00:01:48,743
All right great.

50
00:01:49,710 --> 00:01:51,210
Now another thing to note

51
00:01:51,210 --> 00:01:53,490
about trying to figure out who you are.

52
00:01:53,490 --> 00:01:55,470
Whenever you are a standard user

53
00:01:55,470 --> 00:01:56,670
you're going to see the dollar sign

54
00:01:56,670 --> 00:01:57,900
at the end of the command prompt.

55
00:01:57,900 --> 00:02:00,900
Now if you're root for example you're going to

56
00:02:00,900 --> 00:02:04,410
see the hashtag as noted right there.

57
00:02:04,410 --> 00:02:07,320
And again the command prompt typically shows you

58
00:02:07,320 --> 00:02:08,152
what user you are,

59
00:02:08,152 --> 00:02:10,770
so you don't have to use the "whoami".

60
00:02:10,770 --> 00:02:12,840
But just in case your on a Linux distribution

61
00:02:12,840 --> 00:02:14,100
that doesn't show that,

62
00:02:14,100 --> 00:02:16,110
you can easily use the "whoami" command,

63
00:02:16,110 --> 00:02:17,190
and let you know who you are.

64
00:02:17,190 --> 00:02:20,730
But again the command prompt will tell you who you are.

65
00:02:20,730 --> 00:02:22,950
The "who" command displays details of the user

66
00:02:22,950 --> 00:02:25,050
currently logged into the system.

67
00:02:25,050 --> 00:02:27,600
The output of the "who" command includes the username,

68
00:02:27,600 --> 00:02:30,090
the name of the system from which the user's connected,

69
00:02:30,090 --> 00:02:31,470
and the date and time that the user

70
00:02:31,470 --> 00:02:33,090
has been connected since.

71
00:02:33,090 --> 00:02:34,793
So let's try this out really quick.

72
00:02:35,910 --> 00:02:37,840
So of course we see I'm logged in

73
00:02:39,300 --> 00:02:41,490
and we're going to see which system I'm logged in from.

74
00:02:41,490 --> 00:02:44,403
So the first one the dot zero means local.

75
00:02:45,630 --> 00:02:48,660
Now also the PST for a little GWiz,

76
00:02:48,660 --> 00:02:51,690
stands for Pseudo Terminal Slave.

77
00:02:51,690 --> 00:02:53,220
Now if you want more information about that,

78
00:02:53,220 --> 00:02:54,053
you can look it up.

79
00:02:54,053 --> 00:02:56,580
It's a little bit beyond the depth and scope

80
00:02:56,580 --> 00:02:59,430
of this lesson but that's just a little GWiz there.

81
00:02:59,430 --> 00:03:01,950
But the most things thing we need to focus on

82
00:03:01,950 --> 00:03:04,770
is the logged in date

83
00:03:04,770 --> 00:03:06,300
and time.

84
00:03:06,300 --> 00:03:09,360
Typically, it says local user,

85
00:03:09,360 --> 00:03:11,730
and you can see that by again the colon zero.

86
00:03:11,730 --> 00:03:13,470
Now if we was logged into a remote system

87
00:03:13,470 --> 00:03:17,850
it would have either the IP address or the DNS name there.

88
00:03:17,850 --> 00:03:20,200
So that's a little bit about the "who" command.

89
00:03:21,810 --> 00:03:25,200
The next command we're going to go over is the "w" command.

90
00:03:25,200 --> 00:03:28,140
The "w" command's primarily used to display details

91
00:03:28,140 --> 00:03:30,690
of users who are currently logged into the system,

92
00:03:30,690 --> 00:03:33,540
and the transactions that they're currently performing so

93
00:03:34,500 --> 00:03:36,840
Simply put I'm the only one logged into the system

94
00:03:36,840 --> 00:03:40,170
but we see here that the first timestamp,

95
00:03:40,170 --> 00:03:42,360
it gives us information about the system.

96
00:03:42,360 --> 00:03:47,360
So you see the current time 16:52:21 the system is up.

97
00:03:47,670 --> 00:03:49,890
There's two users logged in load average,

98
00:03:49,890 --> 00:03:50,910
things of that nature.

99
00:03:50,910 --> 00:03:52,350
The next set of information

100
00:03:52,350 --> 00:03:55,020
is going to be information about the user,

101
00:03:55,020 --> 00:03:57,120
and the current transaction that I'm doing.

102
00:03:57,120 --> 00:03:58,530
If you look at the beginning

103
00:03:58,530 --> 00:03:59,580
and just really look at the

104
00:03:59,580 --> 00:04:02,370
the what portion is what we're going to focus on right here,

105
00:04:02,370 --> 00:04:06,210
you can see the file path and that kind of tells,

106
00:04:06,210 --> 00:04:08,970
and give a hint of what the user is currently doing.

107
00:04:08,970 --> 00:04:11,940
So we can see right now I'm logged into "bash"

108
00:04:11,940 --> 00:04:13,890
or the what is the folder is for the bash.

109
00:04:13,890 --> 00:04:17,399
'Cos this is where we execute all of our terminal commands.

110
00:04:17,399 --> 00:04:19,410
So now we can see what I'm currently doing based

111
00:04:19,410 --> 00:04:21,779
off the folder that I am logged into

112
00:04:21,779 --> 00:04:23,043
under the "what" column.

113
00:04:24,180 --> 00:04:25,720
And last but not least

114
00:04:26,880 --> 00:04:28,740
we're going to use the "last" command.

115
00:04:28,740 --> 00:04:31,500
Now this command shows a history of the user login

116
00:04:31,500 --> 00:04:34,740
and log out actions with actual date and times.

117
00:04:34,740 --> 00:04:39,150
We'll see here that it shows me logging in

118
00:04:39,150 --> 00:04:42,540
and the time I logged out and also the session duration.

119
00:04:42,540 --> 00:04:45,030
This is a good security auditing tool.

120
00:04:45,030 --> 00:04:46,620
Most of them will have an automated process to

121
00:04:46,620 --> 00:04:47,453
check these things for us.

122
00:04:47,453 --> 00:04:49,440
But if we want to do a manual process

123
00:04:49,440 --> 00:04:50,850
and use this "last" command,

124
00:04:50,850 --> 00:04:53,160
we can see what users are logging in and out,

125
00:04:53,160 --> 00:04:55,620
what process are potentially are logging in and out

126
00:04:55,620 --> 00:04:59,313
etcetera so we can see any abnormal activities.

127
00:05:00,210 --> 00:05:02,760
So to sum things up we went over a few of the commands;

128
00:05:02,760 --> 00:05:06,173
the "who" command the "id" command the "w" command,

129
00:05:06,173 --> 00:05:09,270
the "last" command and the "whoami" command.

130
00:05:09,270 --> 00:05:11,610
These are going to be invaluable

131
00:05:11,610 --> 00:05:13,620
to you as a system administrator.

132
00:05:13,620 --> 00:05:16,230
And they are quick ways to get information about users

133
00:05:16,230 --> 00:05:17,790
and group accounts

134
00:05:17,790 --> 00:05:19,590
and I'll see you in the next lesson.