13:42:25
|
#ls -l /var/log/wtmp
ls: /var/log/wtmptmp: No such file or directory |
| /l3/users/27-07-2009/nt-ladm/debian2.net.nt/user :1 :2 :3 :4 :5 :6 :7 :8 :9 :10 :11 :12 :13 :14 |
|
|
#[root@fbsd1:~]# ps waux | grep login
[root@fbsd1:~]# ps waux | grep login root 5104 0,0 0,3 1764 1460 v0 Ss+ 14:38 0:00,01 login [pam] (login) root 5208 0,0 0,2 1612 1068 p1 S+ 14:39 0:00,00 grep login root 5104 0,0 0,3 1764 1460 v0 Ss+ 14:38 0:00,01 login [pam] (login) |
|
#[root@fbsd1:~]# ps waux | grep login
root 5104 0,0 0,3 1764 1460 v0 Ss+ 14:38 0:00,01 login [pam] (login) |
|
#ls -l /var/log/btmp
[root@fbsd1:~]# exit exit Connection to 192.168.16.21 closed. -rw-rw-r-- 1 root utmp 0 2009-07-25 06:26 /var/log/btmp |
|
#ls -l /var/log/wtmp
ls: /var/log/wtmptmp: No such file or directory |
|
#ls -l /var/log/wtmp
wtmp wtmp.1 |
|
#ls -l /var/log/wtmp
-rw-rw-r-- 1 root utmp 8448 2009-07-30 11:37 /var/log/wtmp |
|
#lastb
btmp begins Sat Jul 25 06:26:59 2009 |
|
#lastb
root Thu Jul 30 14:43 - 14:43 (00:00) root Thu Jul 30 14:43 - 14:43 (00:00) btmp begins Thu Jul 30 14:43:38 2009 |
|
$su -
Password: l3-agent is already running: pid=2150; pidfile=/root/.lilalo/l3-agent.pid |
|
#lastlog
user155 **Никогда не входил в систему** user156 **Никогда не входил в систему** user157 **Никогда не входил в систему** user158 **Никогда не входил в систему** user159 **Никогда не входил в систему** user160 **Никогда не входил в систему** user161 **Никогда не входил в систему** user162 **Никогда не входил в систему** user163 **Никогда не входил в систему** user164 **Никогда не входил в систему** ... user991 **Никогда не входил в систему** user992 **Никогда не входил в систему** user993 **Никогда не входил в систему** user994 **Никогда не входил в систему** user995 **Никогда не входил в систему** user996 **Никогда не входил в систему** user997 **Никогда не входил в систему** user998 **Никогда не входил в систему** user999 **Никогда не входил в систему** user1000 **Никогда не входил в систему** |
|
#last
user186 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user187 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user188 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user189 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user190 ttype 127.0.0.1 ЧÑв ÐÐ°Ñ 13 15:16:47 +0200 2008 user191 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user192 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user193 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user194 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user195 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** ... user919 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user920 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user921 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user922 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user923 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user924 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user925 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user926 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user927 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** user928 **Ðикогда не Ð²Ñ Ð¾Ð´Ð¸Ð» в ÑиÑÑемÑ** |
|
#vim /etc/passwd
|
|
#man shadow
|
|
#adduser
adduser: Можно указать только одно или два имени. |
|
#adduser adduser
Добавляется пользователь `adduser' ...
Добавляется новая группа `adduser' (1305) ...
Добавляется новый пользователь `adduser' (1305) в группу `adduser' ...
Создаётся домашний каталог `/home/adduser' ...
Копирование файлов из `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: пароль успешно обновлён
Изменение информации о пользователе adduser
Введите новое значение или нажмите ВВОД для выбора значения по умолчанию
Полное имя []: Add User
Номер комнаты []: D
Рабочий телефон []: 02
Домашний телефон []: 03
Другое []: other
Данная информация корректна? [д/Н] y
|
|
#useradd -m -d /home/useradd -s /bin/bash -u 5000
-K, --key KEY=VALUE overrides /etc/login.defs defaults
-m, --create-home create home directory for the new user
account
-o, --non-unique allow create user with duplicate
(non-unique) UID
-p, --password PASSWORD use encrypted password for the new user
account
-r, --system create a system account
-s, --shell SHELL the login shell for the new user account
-u, --uid UID force use the UID for the new user account
|
|
#useradd -m -d /home/useradd -s /bin/bash -u 5000 | less
|
|
#useradd -m -d /home/useradd -s /bin/bash -u 5000 useradd
|
|
#vim /etc/shadow
|
|
#vim /etc/shadow
|
|
#usermod -L
[root@debian2:~]# usermod -l useradd
Usage: usermod [options] LOGIN
Options:
-c, --comment COMMENT new value of the GECOS field
-d, --home HOME_DIR new home directory for the user account
-e, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE
-f, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-g, --gid GROUP force use GROUP as new primary group
-G, --groups GROUPS new list of supplementary GROUPS
...
-h, --help display this help message and exit
-l, --login NEW_LOGIN new value of the login name
-L, --lock lock the user account
-m, --move-home move contents of the home directory to the new
location (use only with -d)
-o, --non-unique allow using duplicate (non-unique) UID
-p, --password PASSWORD use encrypted password for the new password
-s, --shell SHELL new login shell for the user account
-u, --uid UID new UID for the user account
-U, --unlock unlock the user account
|
|
#usermod -D
-h, --help display this help message and exit
-l, --login NEW_LOGIN new value of the login name
-L, --lock lock the user account
-m, --move-home move contents of the home directory to the new
location (use only with -d)
-o, --non-unique allow using duplicate (non-unique) UID
-p, --password PASSWORD use encrypted password for the new password
-s, --shell SHELL new login shell for the user account
-u, --uid UID new UID for the user account
-U, --unlock unlock the user account
|
|
#usermod -U
|
|
#vim /etc/shadow
|
|
#mount
92 user945: 49: 293 user946:x:1250:$ 94 user947: 51: 295 user948:x:1252:$ 96 user949: 53: 297 user950:x:1254:$ 98 user951: 55: 299 user952:x:1256:$ 300 user953:x:1257:$ 301 user954:x:1258:$ /dev/hda1 on / type reiserfs (rw) tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755) proc on /proc type proc (rw,noexec,nosuid,nodev) sysfs on /sys type sysfs (rw,noexec,nosuid,nodev) udev on /dev type tmpfs (rw,mode=0755) 293 user946:x:1250:$ 271,1 82% |
|
#vim /etc/fstab
|
|
#ps
PID TTY TIME CMD 23494 ttyp3 00:00:00 bash 24156 ttyp3 00:00:00 ps |
|
#ps -o cmd,time,user,cpu,vss,rss
ERROR: Unknown user-defined format specifier "vss". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty g OBSOLETE -- DO NOT USE -u by effective user ID (supports names) ... -o,o user-defined -f full --Group --User --pid --cols --ppid -j,j job control s signal --group --user --sid --rows --info -O,O preloaded -o v virtual memory --cumulative --format --deselect -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy |
|
#ps
PID TTY TIME CMD 23494 ttyp3 00:00:00 bash 24172 ttyp3 00:00:00 ps |
|
#ps -o cmd,time
ERROR: Unknown user-defined format specifier "times". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty g OBSOLETE -- DO NOT USE -u by effective user ID (supports names) ... -o,o user-defined -f full --Group --User --pid --cols --ppid -j,j job control s signal --group --user --sid --rows --info -O,O preloaded -o v virtual memory --cumulative --format --deselect -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy |
|
#ps -o CMD
ERROR: Unknown user-defined format specifier "CMD". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty g OBSOLETE -- DO NOT USE -u by effective user ID (supports names) ... -o,o user-defined -f full --Group --User --pid --cols --ppid -j,j job control s signal --group --user --sid --rows --info -O,O preloaded -o v virtual memory --cumulative --format --deselect -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy |
|
#ps -o cmd
[root@debian2:~]# ps -o CMD ERROR: Unknown user-defined format specifier "CMD". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty ... -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy CMD bash -i ps -o cmd |
|
#ps -o cmd,user
CMD USER bash -i root ps -o cmd,user root |
|
#ps -o cmd,user,cpu
CMD USER CPU bash -i root - ps -o cmd,user,cpu root - |
|
#ps -o cmd,user,cpu,RSS
ERROR: Unknown user-defined format specifier "RSS". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty g OBSOLETE -- DO NOT USE -u by effective user ID (supports names) ... -o,o user-defined -f full --Group --User --pid --cols --ppid -j,j job control s signal --group --user --sid --rows --info -O,O preloaded -o v virtual memory --cumulative --format --deselect -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy |
|
#ps -o cmd,user,cpu,rss
CMD USER CPU RSS bash -i root - 1832 ps -o cmd,user,cpu,rss root - 972 |
|
#ps -o cmd,user,cpu,rss,vss
ERROR: Unknown user-defined format specifier "vss". ********* simple selection ********* ********* selection by list ********* -A all processes -C by command name -N negate selection -G by real group ID (supports names) -a all w/ tty except session leaders -U by real user ID (supports names) -d all except session leaders -g by session OR by effective group name -e all processes -p by process ID T all processes on this terminal -s processes in the sessions given a all w/ tty, including other users -t by tty g OBSOLETE -- DO NOT USE -u by effective user ID (supports names) ... -o,o user-defined -f full --Group --User --pid --cols --ppid -j,j job control s signal --group --user --sid --rows --info -O,O preloaded -o v virtual memory --cumulative --format --deselect -l,l long u user-oriented --sort --tty --forest --version -F extra full X registers --heading --no-heading --context ********* misc options ********* -V,V show version L list format codes f ASCII art forest -m,m,-L,-T,H threads S children in sum -y change -l format -M,Z security data c true command name -c scheduling class -w,w wide output n numeric WCHAN,UID -H process hierarchy |
|
#ps -w
[root@debian2:~]# ps -o cmd,user,cpu,rss,time CMD USER CPU RSS TIME bash -i root - 1832 00:00:00 ps -o cmd,user,cpu,rss,time root - 968 00:00:00 Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 1960 216 ? Ss Jul27 0:00 init [2] root 2 0.0 0.0 0 0 ? S Jul27 0:00 [migration/0] root 3 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S< Jul27 0:00 [events/0] ... user 23623 0.0 0.0 4504 508 ttyp4 Ss+ 14:43 0:00 script -f -q /home/user/.lilalo//30515151255132057-1248954185.scrip user 23664 0.0 0.0 4632 428 ttyp4 S+ 14:43 0:00 script -f -q /home/user/.lilalo//30515151255132057-1248954185.scrip user 23665 0.0 0.3 6368 2124 ttyp7 Ss 14:43 0:00 bash -i root 23694 0.0 0.1 5460 1068 ttyp7 S+ 14:43 0:00 su - root 23695 0.0 0.1 4712 676 ttyp7 S+ 14:43 0:00 script -f -q /root/.lilalo//163452943122335421-1248954191.script root 23734 0.0 0.0 4840 468 ttyp7 S+ 14:43 0:00 script -f -q /root/.lilalo//163452943122335421-1248954191.script root 23735 0.0 0.3 5792 1792 ttyp8 Ss 14:43 0:00 bash -i root 23758 0.0 0.3 4484 2292 ttyp8 S+ 14:43 0:00 ssh 192.168.16.254 root 23759 0.0 0.0 1584 492 tty1 Ss+ 14:43 0:00 /sbin/getty 38400 tty1 root 24260 0.0 0.1 5172 988 ttyp3 R+ 16:52 0:00 ps -waux |
|
#ps
[root@debian2:~]# ps -waux | less Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 1960 216 ? Ss Jul27 0:00 init [2] root 2 0.0 0.0 0 0 ? S Jul27 0:00 [migration/0] root 3 0.0 0.0 0 0 ? SN Jul27 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S< Jul27 0:00 [events/0] root 5 0.0 0.0 0 0 ? S< Jul27 0:00 [khelper] root 6 0.0 0.0 0 0 ? S< Jul27 0:00 [kthread] root 7 0.0 0.0 0 0 ? S< Jul27 0:00 [xenwatch] ... root 1172 0.0 0.0 1712 284 ? Ss Jul27 0:00 /sbin/klogd -x root 1189 0.0 0.0 4940 524 ? Ss Jul27 0:00 /usr/sbin/sshd root 1204 0.0 0.0 13308 520 ? Ss Jul27 0:00 /usr/sbin/gdm root 1205 0.0 0.0 13788 588 ? S Jul27 0:00 /usr/sbin/gdm root 1215 0.6 5.7 37432 34012 ? S Jul27 31:13 /usr/bin/Xvnc :0 -geometry 1024x768 -depth 24 - auth /var/lib/gdm/:0.Xauth -nolisten tcp root 1216 0.0 0.0 2332 260 ? Ss Jul27 0:00 /usr/sbin/cron PID TTY TIME CMD 23494 ttyp3 00:00:00 bash 24277 ttyp3 00:00:00 ps |
|
#ps -waux | grep ps
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html root 24341 0.0 0.1 5172 984 ttyp3 R+ 16:53 0:00 ps -waux root 24342 0.0 0.1 4624 744 ttyp3 R+ 16:53 0:00 grep ps |
|
#ps -waux | grep firefox
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html user 7584 0.0 11.2 164788 67032 ? Ssl Jul29 0:34 /usr/lib/iceweasel/firefox-bin -a firefox root 24351 0.0 0.1 4620 740 ttyp3 R+ 16:54 0:00 grep firefox |
|
#ps -waux | grep firefox | grep -v grep
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html user 7584 0.0 11.2 164788 67032 ? Ssl Jul29 0:34 /usr/lib/iceweasel/firefox-bin -a firefox |
|
#ps
user 7584 0.0 11.2 164788 67032 ? Ssl Jul29 0:34 /usr/lib/iceweasel/firefox-bin -a firefox |
|
#top
top - 16:55:45 up 3 days, 5:42, 5 users, load average: 0.39, 0.29, 0.27
Tasks: 62 total, 1 running, 61 sleeping, 0 stopped, 0 zombie
Cpu(s): 27.0%us, 10.3%sy, 0.0%ni, 62.3%id, 0.0%wa, 0.0%hi, 0.3%si, 0.0%st
Mem: 594068k total, 587796k used, 6272k free, 69040k buffers
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
Swap: 0k total, 0k used, 0k free, 332776k cached
21017 user 16 0 21400 16m 1412 S 21.0 2.8 4:44.45 l3-agent
1215 root 15 0 37432 33m 1484 S 17.0 5.7 31:49.62 Xvnc
23047 user 15 0 5584 2024 1600 R 0.7 0.3 0:59.83 vncviewer
1 root 15 0 1960 216 120 S 0.0 0.0 0:00.06 init
...
5 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
6 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
7 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 xenwatch
8 root 13 -5 0 0 0 S 0.0 0.0 0:00.00 xenbus
16 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kblockd/0
18 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
57 root 10 -5 0 0 0 S 0.0 0.0 0:00.02 kswapd0
58 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0
609 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kmirrord
707 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 reiserfs/0
|
|
#bg
top - 16:58:50 up 3 days, 5:45, 5 users, load average: 0.59, 0.43, 0.32 Tasks: 62 total, 1 running, 61 sleeping, 0 stopped, 0 zombie Cpu(s): 16.8%us, 10.5%sy, 0.0%ni, 72.1%id, 0.3%wa, 0.0%hi, 0.1%si, 0.1%st Mem: 594068k total, 589608k used, 4460k free, 69036k buffers PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND Swap: 0k total, 0k used, 0k free, 334552k cached 1215 root 15 0 37432 33m 1484 S 19.2 5.7 32:25.26 Xvnc 1,I Toggle SMP view: '1' single/separate states; 'I' Irix/Solaris mode 21017 user 16 0 21400 16m 1412 S 4.2 2.8 4:56.78 l3-agent 2150 root 16 0 11736 6612 984 S 3.4 1.1 2:12.01 l3-agent ... 18 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod d or s Set update interval 57 root 10 -5 0 0 0 S 0.0 0.0 0:00.02 kswapd0 W Write configuration file 58 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0 q Quit 609 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kmirrord ( commands shown with '.' require a visible task display window ) Press 'h' or '?' for help with Windows, any other key to continue |
|
#f
[root@debian2:~]# bash: f: command not found |
|
|