Today I'ma walk you through
how to query users and group accounts.
Once we've created a user and group account,
we're going to typically want to know
how these accounts are being used.
We're also going to want to track activities
at times to ensure these accounts are being used
for their intended purposes.
So, the first command we're going to check
out is the "whoami" command.
Now you see the whoami is very simple.
You type in whoami and it displays the current user
that you are.
Because typically what happens is,
as an administrator we might switch
from account to account and sometimes we can get lost
in the shuffle.
So the whoami is a quick way to see
which user we're currently logged in with.
Now we're just going to
practice a little bit.
Remember if you do substitute user
with just a dash,
it assumes you mean root.
Type in the root password.
"whoami" again.
Now we can see we're currently logged in
as the root.
The next command we're going to go over
is the "id" command.
This simply just shows us our User ID,
also a Group ID and the groups
that we are associated with.
Now currently,
the groups that root is associated with isn't many.
So if we just switch back to me J Kelly,
we'll see that I'm associated with multiple groups.
You can also use the "id"
specifically for another user.
It doesn't have to be who you are.
So for example I use "id" for "ariley".
Let's do "id" for "rstanley" oh there's no "rstanley"
Let's see what other users we have in our queue.
I'm going to go again "etc" "cat".
See which ones we can look up.
"cmason" let's try that one.
Another ID with C.
See their information there.
All right great.
Now another thing to note
about trying to figure out who you are.
Whenever you are a standard user
you're going to see the dollar sign
at the end of the command prompt.
Now if you're root for example you're going to
see the hashtag as noted right there.
And again the command prompt typically shows you
what user you are,
so you don't have to use the "whoami".
But just in case your on a Linux distribution
that doesn't show that,
you can easily use the "whoami" command,
and let you know who you are.
But again the command prompt will tell you who you are.
The "who" command displays details of the user
currently logged into the system.
The output of the "who" command includes the username,
the name of the system from which the user's connected,
and the date and time that the user
has been connected since.
So let's try this out really quick.
So of course we see I'm logged in
and we're going to see which system I'm logged in from.
So the first one the dot zero means local.
Now also the PST for a little GWiz,
stands for Pseudo Terminal Slave.
Now if you want more information about that,
you can look it up.
It's a little bit beyond the depth and scope
of this lesson but that's just a little GWiz there.
But the most things thing we need to focus on
is the logged in date
and time.
Typically, it says local user,
and you can see that by again the colon zero.
Now if we was logged into a remote system
it would have either the IP address or the DNS name there.
So that's a little bit about the "who" command.
The next command we're going to go over is the "w" command.
The "w" command's primarily used to display details
of users who are currently logged into the system,
and the transactions that they're currently performing so
Simply put I'm the only one logged into the system
but we see here that the first timestamp,
it gives us information about the system.
So you see the current time 16:52:21 the system is up.
There's two users logged in load average,
things of that nature.
The next set of information
is going to be information about the user,
and the current transaction that I'm doing.
If you look at the beginning
and just really look at the
the what portion is what we're going to focus on right here,
you can see the file path and that kind of tells,
and give a hint of what the user is currently doing.
So we can see right now I'm logged into "bash"
or the what is the folder is for the bash.
'Cos this is where we execute all of our terminal commands.
So now we can see what I'm currently doing based
off the folder that I am logged into
under the "what" column.
And last but not least
we're going to use the "last" command.
Now this command shows a history of the user login
and log out actions with actual date and times.
We'll see here that it shows me logging in
and the time I logged out and also the session duration.
This is a good security auditing tool.
Most of them will have an automated process to
check these things for us.
But if we want to do a manual process
and use this "last" command,
we can see what users are logging in and out,
what process are potentially are logging in and out
etcetera so we can see any abnormal activities.
So to sum things up we went over a few of the commands;
the "who" command the "id" command the "w" command,
the "last" command and the "whoami" command.
These are going to be invaluable
to you as a system administrator.
And they are quick ways to get information about users
and group accounts
and I'll see you in the next lesson.