Chapter 17. System and Administrative Commands 笔记

Users and Groups

users

    Show all logged on users. This is the approximate equivalent of who -q.  man who
groups

    Lists the current user and the groups she belongs to. This corresponds to the $GROUPS internal variable, but gives the group names, rather than the numbers.  列出当前用户所属于的组

    bash$ groups
    bozita cdrom cdwriter audio xgrp        -- groups 显示所有该用户所在的组名

    bash$ echo $GROUPS                      -- 只显示该用户的私有组
    501

chown, chgrp

    The chown command changes the ownership of a file or files. This command is a useful method that root can use to shift file ownership from one user to another. An ordinary user may not change the ownership of files, not even her own files. [1] -- chown 可以改变文件属于那个那个用户；只有root 可以有这个权利

    root# chown bozo *.txt



    The chgrp command changes the group ownership of a file or files. You must be owner of the file(s) as well as a member of the destination group (or root) to use this operation.  --可以改变一个文件的属组，1 你必须是一个文件的owner 2 你必须是要修改目标组的成员

    chgrp --recursive dunderheads *.data
    #  The "dunderheads" group will now own all the "*.data" files
    #+ all the way down the $PWD directory tree (that's what "recursive" means).

useradd, userdel

    The useradd administrative command adds a user account to the system and creates a home directory for that particular user, if so specified. The corresponding userdel command removes a user account from the system [2] and deletes associated files.

    Note

    The adduser command is a synonym for useradd and is usually a symbolic link to it.
-- useradd 增加用户，userdel 删除用户  adduser 是useradd 的一个链接，调用的还是useradd 命令
usermod

    Modify a user account. Changes may be made to the password, group membership, expiration date, and other attributes of a given user's account. With this command, a user's password may be locked, which has the effect of disabling the account.     --可以对账号进行进一步操作
groupmod

    Modify a given group. The group name and/or ID number may be changed using this command.

id

    The id command lists the real and effective user IDs and the group IDs of the user associated with the current process. This is the counterpart to the $UID, $EUID, and $GROUPS internal Bash variables.

    bash$ id
    uid=501(bozo) gid=501(bozo) groups=501(bozo),22(cdrom),80(cdwriter),81(audio)

    bash$ echo $UID
    501

    Note

    The id command shows the effective IDs only when they differ from the real ones.

    Also see Example 9-5.
lid

    The lid (list ID) command shows the group(s) that a given user belongs to, or alternately, the users belonging to a given group. May be invoked only by root.

    root# lid bozo
     bozo(gid=500)


    root# lid daemon
     bin(gid=1)
      daemon(gid=2)
      adm(gid=4)
      lp(gid=7)


who

    Show all users logged on to the system.

    bash$ who
    bozo  tty1     Apr 27 17:45
     bozo  pts/0    Apr 27 17:46
     bozo  pts/1    Apr 27 17:47
     bozo  pts/2    Apr 27 17:49


    The -m gives detailed information about only the current user. Passing any two arguments to who is the equivalent of who -m, as in who am i or who The Man.

    bash$ who -m
    localhost.localdomain!bozo  pts/2    Apr 27 17:49


    whoami is similar to who -m, but only lists the user name.

    bash$ whoami
    bozo


w

    Show all logged on users and the processes belonging to them. This is an extended version of who. The output of w may be piped to grep to find a specific user and/or process.

    bash$ w | grep startx
    bozo  tty1     -                 4:22pm  6:41   4.47s  0.45s  startx

logname

    Show current user's login name (as found in /var/run/utmp). This is a near-equivalent to whoami, above.

    bash$ logname
    bozo

    bash$ whoami
    bozo

    However . . .

    bash$ su
    Password: ......

    bash# whoami
    root
    bash# logname
    bozo

    Note

    While logname prints the name of the logged in user, whoami gives the name of the user attached to the current process. As we have just seen, sometimes these are not the same.
su

    Runs a program or script as a substitute user. su rjones starts a shell as user rjones. A naked su defaults to root. See Example A-14.
sudo

    Runs a command as root (or another user). This may be used in a script, thus permitting a regular user to run the script.

    #!/bin/bash

    # Some commands.
    sudo cp /root/secretfile /home/bozo/secret
    # Some more commands.

    The file /etc/sudoers holds the names of users permitted to invoke sudo.
passwd

    Sets, changes, or manages a user's password.

    The passwd command can be used in a script, but probably should not be.

    Example 17-1. Setting a new password

    #!/bin/bash
    #  setnew-password.sh: For demonstration purposes only.
    #                      Not a good idea to actually run this script.
    #  This script must be run as root.

    ROOT_UID=0         # Root has $UID 0.
    E_WRONG_USER=65    # Not root?

    E_NOSUCHUSER=70
    SUCCESS=0


    if [ "$UID" -ne "$ROOT_UID" ]
    then
      echo; echo "Only root can run this script."; echo
      exit $E_WRONG_USER
    else
      echo
      echo "You should know better than to run this script, root."
      echo "Even root users get the blues... "
      echo
    fi


    username=bozo
    NEWPASSWORD=security_violation

    # Check if bozo lives here.
    grep -q "$username" /etc/passwd
    if [ $? -ne $SUCCESS ]
    then
      echo "User $username does not exist."
      echo "No password changed."
      exit $E_NOSUCHUSER
    fi

    echo "$NEWPASSWORD" | passwd --stdin "$username"
    #  The '--stdin' option to 'passwd' permits
    #+ getting a new password from stdin (or a pipe).

    echo; echo "User $username's password
echo; echo "User $username's password changed!"

# Using the 'passwd' command in a script is dangerous.

exit 0
The passwd command's -l, -u, and -d options permit
	      locking, unlocking, and deleting a user's password. Only root may use these options.
				

				
					
						
							点击(此处)折叠或打开
						
					
					
						ac命令根据当前的/var/log/wtmp文件中的登录进入和退出来报告用户连接的时间（小时）,如果不使用标志,则报告总的时间.例如,键入ac命令,然后按回车键,将显示如下内容：
[root@server /]# ac
        total 1103.66
ac -d命令,然后按回车键,将显示每天的总的连接时间：
ac -d
Dec 10 total 14.83
Dec 11 total 9.58
Dec 12 total 35.34
Dec 13 total 63.00
Dec 14 total 59.12
Dec 15 total 92.32
Dec 16 total 65.10
Dec 17 total 46.83
Dec 18 total 12.27
Dec 19 total 62.26
ac -p命令,然后按回车键,将显示每个用户的总的连接时间：

ac -dp 可以查看每个人每天连上来的时候 ， 在服务器上可以查看某天连个人有没有登陆上来。
Dec 27 total 7.13
        root 0.32
        s-p 8.38
Dec 28 total 8.70
        s-p 16.11
Dec 29 total 16.11
        s-p 8.54
        x-y 1.02
Today total 9.56
last

List last logged in users, as read from /var/log/wtmp. This command can also show remote logins.

For example, to show the last few times the system rebooted:

bash$ last reboot reboot system boot  2.6.9-1.667      Fri Feb  4 18:18 (00:02)
 reboot system boot  2.6.9-1.667      Fri Feb  4 15:20 (01:27)
 reboot system boot  2.6.9-1.667      Fri Feb  4 12:56 (00:49)
 reboot system boot  2.6.9-1.667      Thu Feb  3 21:08 (02:17)
 . . .

 wtmp begins Tue Feb  1 12:50:09 2005
last root  # root 用户登陆的情况
					
				
				
					
				
				
					
						
							点击(此处)折叠或打开
						
					
					
						Information and Statistics

uname

    Output system specifications (OS, kernel version, etc.) to stdout. Invoked with the -a option, gives verbose system info (see Example 16-5). The -s option shows only the OS type.

    bash$ uname
    Linux

    bash$ uname -s
    Linux


    bash$ uname -a
    Linux iron.bozo 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006
     i686 i686 i386 GNU/Linux

arch

    Show system architecture. Equivalent to uname -m. See Example 11-26.

    bash$ arch
    i686

    bash$ uname -m
    i686

lastcomm

    Gives information about previous commands, as stored in the /var/account/pacct file. Command name and user name can be specified by options. This is one of the GNU accounting utilities.
lastlog

    List the last login time of all system users. This references the /var/log/lastlog file.

    bash$ lastlog
    root          tty1                      Fri Dec  7 18:43:21 -0700 2001
     bin **Never logged in**
     daemon **Never logged in**
     ...
     bozo          tty1                      Sat Dec  8 21:14:29 -0700 2001

    bash$ lastlog | grep root
    root          tty1                      Fri Dec  7 18:43:21 -0700 2001


    Caution

    This command will fail if the user invoking it does not have read permission for the /var/log/lastlog file.
lsof

    List open files. This command outputs a detailed table of all currently open files and gives information about their owner, size, the processes associated with them, and more. Of course, lsof may be piped to grep and/or awk to parse and analyze its results.

    bash$ lsof
    COMMAND PID    USER   FD TYPE DEVICE SIZE NODE NAME
     init 1    root  mem    REG        3,5   30748    30303 /sbin/init
     init 1    root  mem    REG        3,5   73120     8069 /lib/ld-2.1.3.so
     init 1    root  mem    REG        3,5  931668     8075 /lib/libc-2.1.3.so
     cardmgr    213    root  mem    REG        3,5   36956    30357 /sbin/cardmgr
     ...


    The lsof command is a useful, if complex administrative tool. If you are unable to dismount a filesystem and get an error message that it is still in use, then running lsof helps determine which files are still open on that filesystem. The -i option lists open network socket files, and this can help trace intrusion or hack attempts.

    bash$ lsof -an -i tcp
    COMMAND PID USER  FD TYPE DEVICE SIZE NODE NAME
     firefox 2330 bozo  32u IPv4   9956       TCP 66.0.118.137:57596->67.112.7.104:http ...
     firefox 2330 bozo  38u IPv4  10535       TCP 66.0.118.137:57708->216.79.48.24:http ...


    See Example 30-2 for an effective use of lsof.
strace

    System trace: diagnostic and debugging tool for tracing system calls and signals. This command and ltrace, following, are useful for diagnosing why a given program or package fails to run . . . perhaps due to missing libraries or related causes.

    bash$ strace df
    execve("/bin/df", ["df"], [/* 45 vars */]) = 0
     uname({sys="Linux", node="bozo.localdomain", ...}) = 0
     brk(0) = 0x804f5e4

     ...


    This is the Linux equivalent of the Solaris truss command.
ltrace

    Library trace: diagnostic and debugging tool that traces library calls invoked by a given command.

    bash$ ltrace df
    __libc_start_main(0x804a910, 1, 0xbfb589a4, 0x804fb70, 0x804fb68 <unfinished ...>:
     setlocale(6, "") = "en_US.UTF-8"
    bindtextdomain("coreutils", "/usr/share/locale") = "/usr/share/locale"
    textdomain("coreutils") = "coreutils"
    __cxa_atexit(0x804b650, 0, 0, 0x8052bf0, 0xbfb58908) = 0
    getenv("DF_BLOCK_SIZE") = NULL

     ...


nc

    The nc (netcat) utility is a complete toolkit for connecting to and listening to TCP and UDP ports. It is useful as a diagnostic and testing tool and as a component in simple script-based HTTP clients and servers.

    bash$ nc localhost.localdomain 25
    220 localhost.localdomain ESMTP Sendmail 8.13.1/8.13.1;
     Thu, 31 Mar 2005 15:41:35 -0700




free 
								
									Shows memory and cache usage in tabular form. The
	      output of this command lends itself to parsing, using ,  or Perl. The procinfo command shows all the
	      information that free does, and much
	      more.
bash$ free | grep Mem | awk '{ print $4 }' 1880
dmesg 
									
									
										
											Lists all system bootup messages to stdout. Handy for debugging and
	      ascertaining which device drivers were installed
	      and which system interrupts in use. The output
	      of dmesg may, of course, be
	      parsed with , , or  from within a script.

stat 
								
									Gives detailed and verbose statistics 
	      on a given file (even a directory or device file) or set
	      of files.
vmstat 
								
									Display virtual memory statistics.
uptime 
								
									Shows how long the system has been running, along with
	      associated statistics.
    sar 
								
									Invoking sar (System Activity Reporter)
	      gives a very detailed rundown on system statistics. The
	      Santa Cruz Operation ("Old" SCO) released sar as Open Source in June, 1999.
								
								
									This command is not part of the base Linux distribution,
	      but may be obtained as part of the package, written by .