In this lecture, we'll be talking about user account monitoring, which means finding out who's logged 1
into the system and what the users do. Because in Linux you can log in as a user and become another 2
one by running the su commeand that there are two concepts: the real user ID and the effective user ID. 3
The real user ID or are RUID is the id of the user who initially logs in and never changes. 4
On the other hand, EUID or effective user ID is the id of the user 5
who executes a command in the shell. 6
Maybe this seems weird 7
so let me show you practically what I mean. In this terminal, I am logged in as student. 8
This is the real user ID, but I can become root by running sudo su. 9
Now, the effective user ID is root. Let's move ahead to user monitoring. The first command 10
we’ll cover is whoami. 11
As its name suggests, the whoami command, written in one word, prints out the user name of the effective 12
user ID who is root in this case. whoami 13
root 14
It’s equivalent to id -un 15
To display the name of the real user id run who 16
The name of the user who initially logged in is student. Another useful command is id, which prints 17
the effective user and its groups. 18
If you want to find out who's logged into your system run who. What the who command does is parsing 19
and displaying the contents of /var/run/utmp This is the file which logs the current users 20
on the system. 21
There is also another file called wtmp in /var/log which is like history for the utmp 22
file. 23
It doesn't look too good, it maintains the logs of all logged in and logged out users in the past. 24
This is the file. 25
At this moment, there is only one user logged in. 26
But I have another VM where CentOS is running and using ssh I'm going to connect to this Ubuntu VM. 27
In order to be able to do that, the ssh demon should be running on Ubuntu. Install it 28
if you haven't done yet by running sudo apt install openssh-server 29
And check that the service is running by executing sudo systemctl status ssh 30
And it's running. I'm already logged in as root, so it's not necessary to run the commands by prefixing 31
them with sudo; use sudo only if you run 32
the command as an nonprivileged user. Check the network connectivity by pinging Ubuntu from CentOS. Let's see 33
what's the IP address of Ubuntu: 192.168.0.112 34
So from CentOS I am pinging Ubuntu. 35
And it's working. 36
In order to be able to ping and connect using ssh, you have to put the network interfaces into bridged 37
mode on both the Ubuntu and CentOS VMs. 38
So here go to network settings and the network should be put into the bridged mode. 39
I'm connecting using ssh to Ubuntu: ssh, the username student@ and its ip address 40
If I run the WHO command again, we'll see what users are logged in: who - H Note that it's 41
displaying the IP address of the logged in user and the time when it logged in. 42
You can also add the -a option to display more information. 43
For a little more context about users, the simple w command provides a list of who's logged in 44
and what they are doing, what's their current process. 45
The header shows in this order the current time, 46
how long the system has been running, 8 hours and 32 minutes. 47
how many users are currently logged in, 48
and the system load average for the past 1, and 15 minutes. Notice that the values for these 49
load averages should be below 1 or there's a problem. 50
The same information can be displayed running the uptime command. 51
Each time a user logs into the system, a record for that session is written to a file.It’s /var/log/wtmp. 52
The last command will cover is last. 53
It's very useful when you need to track users activity or investigate a possible security breach. 54
It shows a listing of the last logged in users. 55
Last reads the wtmp file, this one, and prints information about the logins and logouts of the users. 56
Records are printed in reverse order, starting from the most recent ones. And if you want to restrict the output 57
to a specific user 58
give that username as argument to last, for example, last student or last root. 59
last reboot 60
The command has some options that could prove useful sometimes and you can find more information about 61
them in the man page of the command.