Hi everybody and welcome to the next video on the Linux operating system module.
And this video to be talking about open files now we've we've mentioned this a lot throughout the course.
Everything is a file in Linux.
Now this is when something's in use such as a network connection the keyboard a text file they're all
considered open while in use while they're being used in some way shape or form and that's important
to know.
So when you have a is writing to a log file that is an open file when you have a network connection
that is a open file.
So it's important to understand that concept so that way you can help troubleshoot and identify things
during an engagement.
Now the main command for this is LSA which is list open files.
Now again this is just listing open files.
So since everything's a file this can this can list anything that's currently open.
Now a few examples of this is we can do a plus D and then give it a directory it'll tell us everything
that's open in that directory what's attaching to it etc. Now we can also search by user.
So if we search for the user brand and we can see all the processes and open files that they're attached
to for that particular user again we can go by service name as well.
This is important.
So you can know if you're currently logged in as a user because let's say they click click on a link
or they ran some code that you wanted them to and now you have access.
Then what open files do you now have access to so the output of this is a it's not difficult but you
should understand the components of it.
Right.
So the first one we have is the command.
This is the actual application that's being ran the PD which is the process for it the user context
space it's actually running in the file descriptor which will go over and a little bit the type will
also go over and a little bit the device tells us what what drive that we're actually on.
So in Linux You're mounting a specific drive.
So whatever device that happens to be ends up here and we have the size of the file the I node number
and the name of the file now the FDA or file descriptor section it uses a few things to identify the
file.
So it tells us what's a current working directory whether it's a text file or whether it's something
around objects loaded into memory which will go over in the next module or when it comes around memory.
And then there is a number which is normally it's appended with a U.
So it's going to be a number with a you at the end which will actually provide you the file description
descriptor number itself.
Now this isn't too terribly important to know right off the bat but just be familiar with this and the
types of values that can it can hold.
Now the Type field this is going to be where you're more likely to poke an interest at now rag is for
regular files.
That's just standard text file whatever it might be desires for directory FIFO First In First Out As
for things like the named pipes symbolic links sockets blocks all that type of stuff that's a first
in first out data structure is going to be in there and then unknown you may or may not see this a lot.
Just know that this normally happens with kernel threads.
It's completely normal.
No need to freak out about it if you see it.
Now we're gonna go through a quick quick look at searching for files right.
So we'll look at that same example.
So if we have less of we run this just as is we get just a large amount of just everything.
It's a lot of data but we're gonna want to sift through that.
Right.
So unless of plus D and then var log.
We need to do that as pseudo
so what we see here is that we have a few files such as the source log off log cups access and then
some some journals.
That's fine.
That just means that this is just means if you had a file for example as a custom log file opening and
you weren't sure if it was still being held onto by a process.
You can look in here and find out what process is currently holding onto that because it labels the
I.D. that's associated with.
Now let's see if we wanted to do we wanted to find the System D.
Right.
So we wanted to find every open file that system the system D process had open right.
So Ellis of dash C and then the name System D.
Or in this case we can do Firefox be up and have that running so we can see Firefox has a a web store
for sequel lite.
It has another sequel like another sequel like some temp some temp stuff.
A lot of UNIX sockets more sequel like more sequel like Eragon.
So next thing we want to do will look by user.
Right.
So of you and then the username.
So in this case Brennan.
All right.
So we've got a lot of stuff because I'm the main user on the system so we're gonna have a lot of stuff
running by default.
But let's say we want to ignore everybody but me or we want to.
We want to grab everybody but my particular user.
So you just put the character but now you're gonna get everybody else.
So in this case it's just root.
And so whatever service accounts that might temporarily be running a specific service.
Now if we want to get network information Ellis of dash by now this is going to show us our network
based connections that are again they're still considered files.
So we can see them here.
So we can see we have three established connections which makes sense because I just loaded up Google
and the web browser.
So this is open files play around with this play around with understanding how to use less of it.
It's an important tool there is a lot of
there's a lot of options and things you can do.
So play around with it get used to it and let us know how you want.