How to grab usernames of ssh connections? - linux

I need a script which cuts every single username with the following command
"ps -ef | grep '[s]shd' | grep -v ^root"
After that, I want to put each user in the following group with that command
"gpasswd -a $user nginx"
Operating system: CentOs 8.2

Cutting the username out of the ps -ef output is possible but tricky and potentially fragile. You should look at the options to ps to get exactly the information you want without anything extraneous.
e.g. ps -C sshd -o user= looks to be close to what you want.

Related

linux ps command to count number of running processes

does anyone know how I can pipe the results of ps -ef | grep ^$USER to wc -1
I already used ps -ef | grep ^$USER but know i want to pipe the command
As per my understanding of your question
you want all the running process from a particular user and pipe it to wc ( note its wc -l not -1)
so i used this
ps aux | grep ^$USER|wc -l
-a : Information for all processes associated with terminals.
-u : Information for processes in userlist.
-x : username (user running this command)
or this can also work
ps -u $USER|wc -l
for any commands if you want to know the details try man command in terminal for example man ps

Catch a process which last less than a second

I'm trying to catch the exact moment a python app makes a system call to ldapsearch command and passes the user password in the command line itself.
The problem is that even with this code :
while :
do
ps -ef | grep 'ldapsearch' | grep -v 'grep' >> out
done
It seems the process is live for such a short time that the ps call misses it every time.
How can I accomplish this?
You can easyly print the log of the system calls with:
dmesg -w
with -w being the follow option.
Or if you know the PID of your process:
strace -p PID

how to get a complete command of X apps via 'wmctl' and 'ps'?

I'm working on a program that can query running X apps, save all the commands of running apps and them reopen them latter.
I encounter an issue. wmctctl can query the pid of Onlyoffice, for example the pid is 123. Then run ps -ef -q 123, I see that the CMD is ./DesktopEditors which should be a invalid command, because ./one_command only can work in special folder include file one_command.
I can get a complete command by running ps -ef -q $(pgrep -P 123).
Is there a straight way to get the complete command of Onlyoffice just via wmctl and ps?
If there is a better way to get all commands of X apps, please let me know. Thanks.
I suggest using ps -h -e -o pid,args command piped with a grep
This should provide full command path with it arguments and options.
For example find all running java programs with their arguments (might be extensive):
ps -eo pid,args | grep java
In your case I suggest a small awk script, that looks for the pid given as 3rd input field in current line:
wmctrl -l -p|awk '{system("ps -h --pid "$3" -o args")}'
Sample output
nautilus-desktop --force
/usr/libexec/gnome-terminal-server
/usr/libexec/gnome-terminal-server
update
Transforming current directory ./ to to full path.
Assuming ./ represent the current working directory.
Add the following pipe.
wmctrl -l -p|awk '{system("ps -h --pid "$3" -o args")}'|sed "s|^\./|$PWD/|"
Find the script or program DesktopEditors in your computer, using find / -name "DesktopEditors".
But I believe this is useless if you are trying to reverse engineer a web based application that requires some kind of a browser emulator.

Only USERID, PID, TIME, and COMMAND for specific user Shell Script

I have to get Only USERID, PID, TIME, and COMMAND for a specific user. I have tried
ps -u user1
But that display
PID TTY TIME CMD, but I dont want the Field TTY.
Can any one help me to find the USERID, PID, TIME, and COMMAND of a specific user
Use the ps option -o to specify the output with uid,pid,time,cmd
ps -u user1 -o uid,pid,time,cmd
You can use this command to get the required details
# ps -e -o pid,time,cmd,user | sed 1q; ps -e -o pid,time,cmd,user | grep '[u]ser_name'
replace username with your user. For example, alen would be '[a]len'

How to find a PID of a process whose name I don't know exactly?

I can get the PID of a specific process name by
pidof$(ps -C netns)
but what if I don't know the name of the process exactly?
I can't type something like
pidof$(ps -C net*)
so is there any wildcard character, or is there another solution?
Use the -A (all processes) option and filter the result through grep:
pidof $(ps -A | grep "net*")
Just use pgrep -l, eg:
$ pgrep -l sh
1821 sshd
2590 ssh-agent
2658 sh
2677 bash
3025 gvfsd-trash
14785 ksh93
17723 ksh93
try the following and see if you can discover the process as such
This will give you all processes for all users, in a full-format listing
ps auxf
where :
axu = To see every process on the system using BSD syntax
f = fullformat
if the list is too long you can filter if you have an idea of the process name
For example the command below will show you the pids for chrome.
ps auxf | grep chrome
you can use grep and pip :
pidof$(ps -c |grep yor_pattern)

Resources