Display some kernel information, hostname, and date/time of the server
uname -a
Linux mcremove 3.13.0-32-generic #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014 i686 i686 i386 GNU/Linux
cat /proc/version
Linux version 3.13.0-32-generic (buildd@toyol) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014
Find OS information like distro name/version.
First you should check if they exist, since depending on your distro these might not exist or have different names. These commands will work for Ubuntu, which is based on Debian.
To check, try: ls -d /etc/* | grep -iE "(release)|(vers)"
cat /etc/lsb-release
DISTRIB_ID=Ubuntu DISTRIB_RELEASE=12.04 DISTRIB_CODENAME=precise DISTRIB_DESCRIPTION="Ubuntu 12.04.5 LTS"
cat /etc/os-release
NAME="Ubuntu" VERSION="12.04.5 LTS, Precise Pangolin" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu precise (12.04.5 LTS)" VERSION_ID="12.04"
cat /etc/debian_version
wheezy/sid
Find if youre on a 32 or 64 bit system:
getconf LONG_BIT
32
Heres a few commands to get disk and mount information:
df -h
Filesystem Size Used Avail Use% Mounted on /dev/vda1 20G 2.6G 16G 14% / udev 239M 8.0K 239M 1% /dev tmpfs 50M 224K 50M 1% /run none 5.0M 0 5.0M 0% /run/lock none 248M 0 248M 0% /run/shm
fdisk -l
WARNING: GPT (GUID Partition Table) detected on '/dev/vda'! The util fdisk doesn't support GPT. Use GNU Parted. Disk /dev/vda: 21.5 GB, 21476933632 bytes 255 heads, 63 sectors/track, 2611 cylinders, total 41947136 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/vda1 1 41947135 20973567+ ee GPT
parted -l
Model: Virtio Block Device (virtblk) Disk /dev/vda: 21.5GB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 1049kB 21.5GB 21.5GB ext4 primary
mount
/dev/vda1 on / type ext4 (rw,noatime,errors=remount-ro) proc on /proc type proc (rw,noexec,nosuid,nodev) sysfs on /sys type sysfs (rw,noexec,nosuid,nodev) none on /sys/fs/fuse/connections type fusectl (rw) none on /sys/kernel/debug type debugfs (rw) none on /sys/kernel/security type securityfs (rw) udev on /dev type devtmpfs (rw,mode=0755) devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620) tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755) none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880) none on /run/shm type tmpfs (rw,nosuid,nodev)
Now lets move on to the actual hardware on the box
List the hardware (or -vv for detailed information):
lspci || lspci -vv
General stuff:
Find suid bit files:
find / -perm 4000 -uid 0 2>/dev/null
Find files owned by a specific user:
find / -user 0
Find files owned by a single user and modified in the last 10 minutes:
find / -user root -cmin 10 | grep -vE "(/proc/)|(/sys/)"