Skip to content
Linux Administration
Lab 4 of 27·10mBeginner

Work out who you are and what you are allowed to do

Read your own identity, group memberships and sudo rights before you need them in an incident.

You need

  • A Linux system with sudo access

Do first

"Permission denied" is the most common message in this job. Answering it starts with knowing what you are.

1. Your identity, in three levels of detail

whoami
id
groups

whoami gives the name, id gives the numeric uid and gid plus every group, groups gives just the names. The numbers are what the kernel actually enforces; the names are a lookup for your benefit.

Verify

id -u # your numeric user id — 0 means you are root

2. What sudo will let you do

sudo -l

This prints your rights without exercising them, which makes it the safe first question. On a machine you have just been given access to it tells you whether you can do the job at all.

Verify

sudo -l # a "User ... may run the following commands" block

3. See the difference root makes

cat /etc/shadow
sudo cat /etc/shadow | head -n 2

The first fails, the second works. /etc/shadow holds password hashes and is mode 640 owned by root:shadow — the canonical example of a file protected by ownership rather than obscurity.

Verify

ls -l /etc/shadow # -rw-r----- 1 root shadow ...

4. Become root deliberately, and leave

sudo -i
whoami
pwd
exit
whoami

sudo -i gives you a root login shell with root's environment. It is the right tool when you have several commands to run, and the wrong one to leave open in a terminal you might forget about.

Verify

whoami # back to your own username after the exit

5. Find out who else has been here

who
last -n 5

who is now, last is history. On a shared or compromised machine these are the first two commands worth running.

Verify

last -n 1 # one login record, most recent first

Where this goes next

You know what you are and what you can do. The quick start ends with a challenge that uses all four labs at once — no steps, just a goal.