Unit 6: Processes and services · Lesson 1 of 6 · 16 min
The process tree
Every running program has an owner and a parent. Map them all.
mission
- You are
- You are building an inventory of what runs on web01.
- Situation
- Nobody wrote down which services this server runs. Every unexplained process is a question for your report.
- Goal
- List every process with its owner and parent.
- Hand in
- A table of processes, owners and whether each is expected.
Draw the tree
pstree -T
lab-init-+-caddy
|-kthreadd
|-lab-gateway---ttyd---bash---pstree
|-python3
|-sleep
|-sshd
`-sync-agent
you should see lab-init is PID 1 in this lab. caddy, lab-gateway and ttyd carry your browser terminal and would not exist on the real server.
Add owners and parents
ps -eo user,ppid,comm --sort=user USER PPID COMMAND dana 1 kthreadd dana 1 sync-agent learner 18 ttyd ... root 0 lab-init root 1 sshd root 1 lab-gateway root 1 caddy root 1 sleep www-data 1 python3 ps -o user,comm -C sshd,python3,sync-agent USER COMMAND root sshd www-data python3 dana sync-agent
you should see Your own shell and ps lines are trimmed here. Two processes run as dana, a developer who should not run services at all.
| Command | What it does |
|---|---|
ps aux | Every process with owner and resources |
ps -eo user,ppid,comm | Pick your own columns |
ps -C name | Processes with a given name |
pstree -T | The tree without threads |
top | Live view by CPU. q quits |
Who started everything
PID 1 starts every other process. In this lab it is lab-init, on a real server systemd.
ps -o pid,user,comm -p 1 PID USER COMMAND 1 root lab-init ps -o user,args -C sync-agent USER COMMAND dana /usr/local/lib/sync/sync-agent -lk 4444
you should see The listener runs as dana with its full command line visible.
What a defender takes away
- 1Every process has a PID, an owner and a parent.
- 2Services should run as dedicated accounts, not people.
- 3Explain every process or list it as a finding.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.