Servers 101: Managing your server - cat, netstat, passwd, nslookup

dimitrisp (68)in #tutorial • 9 years ago

On the 3rd chapter of Servers 101, named Management Series, we will start viewing log files to monitor our server, we'll learn some more commands and we will consider adding some more stuff to our server for better monitoring

Other stuff in the Server 101 series:

Intro and getting into your server - Single Article
Basic Server Security - 3 Parts
Setting up a Web Server - 4 Parts

You can have a look on the previous post of the series, by clicking here

On this post of the Management series we will learn another way of seeing log & text files (though not as great as more/less), and explore various abilities of this tool. We will also learn how to see network connections to other servers, find the IP of a domain name and change our password!.

Cat

The first one we're gonna talk about. For a better explanation than I will ever be able to give, here is the intro from wikipedia:

cat is a standard Unix utility that reads files sequentially, writing them to standard output.
The name is derived from its function to concatenate files.

The simplest, easiest and quickest way to use "cat" is this:

cat /etc/motd

This will display on your screen the contents of file "/etc/motd" (a.k.a. Message Of The Day file, shown when loging in).

cat may seem simple, with no reason of existance, but it isn't like that! With cat you can redirect the output from your screen to anywhere, as it doesn't stop when it reaches a full page (like more and less). For example, if you want to print that motd file, you can do

cat /etc/motd >> /dev/printer

And the job will be done. Another great way to use it, is to concatenate (as the name of the tool is) many files into one. For example, you have a couple of files with the names of all countries, and you want to join them. You can do it almost instantly like this:

cat /path/to/file1 /path/to/file2 /path/to/file3 > /path/to/resultfile

cat will create and open /path/to/resultfile, then open /path/to/file1, output the contents to resultfile, then open /path/to/file2, etc.

If the file exists already, and you want to keep the content that is there, you just have to substitute > with >>. Note, this is not "cat" functionality per se. The final command would be

cat /path/to/file1 /path/to/file2 /path/to/file3 >> /path/to/resultfile

Another way to use cat, would be to make it save your input to a file, like this:

cat >> /path/to/filetowriteto
I, hereby declare that steemit is cool.
Effective Immediately
And it's written to the file!
But now everything you write will go to the file instead.
How to exit this madness?
Simple. Press CTRL+D

and you'll be back to your command line. (See what I did there?)

There are many other uses for cat. I could go on for 3-4 pages like this, but you have gotten an idea. Some switches:

-A: Equivalent to using -vET (read below for those switches)

-b: Number nonempty output lines.

-e: Equivalent to using -vE (Read below)

-E: Show a dollar sign ($) at the end of each line.

-n: Number all lines (gets overriden by -b)

-s: Squeeze repeated empty output lines (so they won't get shown)

-t: Equivalent to --vT

-T: Show TAB character as ^I

-v: Show non-printable characters (won't show TAB and newline [LFD] characters)

Netstat

netstat by default shows a list of open sockets. You can also use it to show the network interfaces list, protocol statistics, kernel routing tables (we used this in the past on a Servers 101 tutorial), and more.

Switch	Description
(no switch)	By default, netstat displays a list of open sockets. If you don't specify any address families, then the active sockets of all configured address families will be printed.
--route, -r	Display the kernel routing tables. See the description in route for details. netstat -r and route -e produce the same output.
--groups, -g	Display multicast group membership information for IPv4 and IPv6.
--interfaces, -i	Display a table of all network interfaces.
--masquerade, -M	Display a list of masqueraded connections.
--statistics, -s	Display summary statistics for each protocol.

netstat is a complex kind of command. You won't really learn a lot on this, here, as it will get very very very long. I will give you some of the most commonly used examples.

netstat -a - Shows all connections that are either listening, establised and waiting. Sample output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0    240 srv0321.node24.bu:10022 ojxg76.static.ote:62119 ESTABLISHED
udp        0      0 srv0321.node24.bu:60237 nl1.takeme.asr.ner:ntp  ESTABLISHED
udp        0      0 srv0321.node24.bu:35888 smtp.mxlo02.routem:ntp  ESTABLISHED
udp        0      0 srv0321.node24.bu:44081 steemit.isverycool:ntp  ESTABLISHED
udp6       0      0 fe81::286:b9af:fb:47670 nl1.takeme.asr.ner:ntp  ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  3      [ ]         DGRAM                    10107    /run/systemd/notify
unix  2      [ ]         DGRAM                    10109    /run/systemd/cgroups-agent
unix  7      [ ]         DGRAM                    10125    /run/systemd/journal/socket
unix  10     [ ]         DGRAM                    10155    /run/systemd/journal/dev-log

netstat -l - Shows just the listening port. Sample output:

Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     19228    /var/run/docker/libcontainerd/docker-containerd.sock
unix  2      [ ACC ]     STREAM     LISTENING     20259    /var/run/docker.sock
unix  2      [ ACC ]     STREAM     LISTENING     24619    /var/run/docker/metrics.sock
unix  2      [ ACC ]     STREAM     LISTENING     12028    /var/lib/openntpd/run/ntpd.sock
unix  2      [ ACC ]     STREAM     LISTENING     14665    /var/run/dbus/system_bus_socket

netstat -s - Shows summary statistics for each protocol. Very important option to monitor the network health of a system or to debug network related issues!

netstat -r - Show kernel routing table. Useful in finding default route for interfaces and network mask.

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         rev-0521382.ote 0.0.0.0         UG        0 0          0 eno1
192.268.0.0     0.0.0.0         255.255.0.0     U         0 0          0 docker0
266.153.251.0   0.0.0.0         255.255.255.0   U         0 0          0 eno1

Changing passwords

Chances are that at some point (sooner or later), you will have to change your password. It is very easy and simple to do. Just type

passwd

You will be asked for your current password, and then you'll have to type your new password twice.

But what if you have forgotten your password? How can you change it? If you have superuser privileges or root access, just type

passwd yourusername

and you will be able to change your password, without knowing it.

And, using the example above, you can also change a different user's password by typing passwd anyusername (obviously)

nslookup

Using nslookup, we can find the IP address of a domain name.

nslookup steemit.com

The result could be this:

Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   steemit.com
Address: 34.206.179.63
Name:   steemit.com
Address: 52.5.54.250
Name:   steemit.com
Address: 52.206.33.12
Name:   steemit.com
Address: 34.201.183.109

The "server" in the first line, is the name server that gave us the answer. In this case, it is the IP 8.8.8.8 (Google's public DNS servers). Below, we can see "name..." and "address..." multiple times.

This usually happens when a domain has "round-robin setup", an old technique to distribute server load.

You might have noticed the "Non-authoritative answer" line. An answer is "authoritative" only if our DNS has the complete zone file information for the domain in question.

More often, our DNS will have a cache of information representing the last authoritative answer it received when it made a similar query; this information is passed on to you, but the server qualifies it as "non-authoritative": the information was recently received from an authoritative source, but the DNS server is not itself that authority.

Using nslookup, you can also do other stuff, such as reverse dns lookups:

nslookup 34.206.179.63

The answer from the server will look like this:

Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
63.179.206.34.in-addr.arpa      name = ec2-34-206-179-63.compute-1.amazonaws.com.

Authoritative answers can be found from:
206.34.in-addr.arpa     nameserver = pdns1.ultradns.net.
206.34.in-addr.arpa     nameserver = x3.amazonaws.org.
206.34.in-addr.arpa     nameserver = x4.amazonaws.org.
206.34.in-addr.arpa     nameserver = x2.amazonaws.com.
206.34.in-addr.arpa     nameserver = x1.amazonaws.com.

Finally, by specifying "-type=recordtype", we can lookup for a specific record.

Example usage:

nslookup -type=mx hotmail.com

This should give us the mail server of Hotmail.

Other record types are "A", "AAAA", "CNAME", "SOA", "ANY".

The fourth part is over. We have learned more commands today, and it is time to put a stop here. Pat yourself in the back for another time!

Main image source: Linux Zone

If you need a place to host your servers consider Vultr, Digital Ocean and BuyVM.

These are affiliate links. If you sign up through them, you support me and I will have more free time to write more content like this.

Also If you signup for Digital Ocean through my affiliate link, you will get $10 to try them out. Note: to battle abusers of this offer, you'll have to make a $5 deposit via Paypal or add your credit/debit card, so they can confirm that you are a new user. I did a deposit via Paypal to test them out, and then I added my credit card so I won't have to deposit money manually every now and then.