Know your identity: whoami, id and groups
You see that every action on Linux runs on behalf of a user and a group, and read user numbers, groups, the files that keep accounts and passwords and their permissions. At the end, like an auditor, you find a second “root” account hidden on the system.
Level 101 · 40 min
The first question a security team asks on a server is: who did this, and what rights does that account have? An attacker asks the same question first, because rights decide what can be touched.
On Linux every user has a name and a number (UID). Users are gathered in groups, and groups often decide who may open a file. It is like a key card in a building: your name is printed on the card, and the doors it opens are stored inside it.
In this lesson you will get to know your own identity, the other accounts on the system and the two files that keep this information. At the end you will write your findings into a short report.
At the start of the lesson I give you the commands; from the middle you type them by hand, and in the last step you only see the goal.
What you will do in this lesson
- Your name and your number: id -un and id -u
- Which groups are you in? groups
- The account book: /etc/passwd and getent
- Looking at other accounts: id nobody
- Where are the passwords? /etc/shadow
- How many accounts are there?
- The UID 0 audit
- Identity report: your first audit record
- Report the backdoor
- Short quiz
Skills you will earn
- Telling UIDs and root (0) apart with id -u
- Reading groups with groups and id -G
- Reading the fields of /etc/passwd
- Looking up accounts with getent
- Inspecting other accounts and least privilege
- Verifying that /etc/shadow is protected
- Counting lines (wc -l)
- Finding hidden accounts with UID 0
- Redirecting output to a file with > and >>
- Writing a short, precise finding
← First lab: open the terminal, meet the server · Linux quick start · Short task: write the ID card of the server and your account →
Start for free