Processes, Services & Packages

To understand a machine you map two things: what is running, and where that software came from. Both are quick to check from the terminal, and both matter to a tester, running services are attack surface, and out-of-date packages are vulnerabilities.

Processes: what is running

A process is a running program. Each has a PID (process id), an owner (user), and a parent.

ps              # your shell's processes
ps aux          # EVERY process: USER, PID, %CPU, %MEM, COMMAND
top             # live, sorted by CPU (q to quit) , htop is the prettier version
ps aux | grep nginx   # is a specific service running?

In ps aux the columns you care about: USER (who it runs as, root is interesting), PID (to act on it), %MEM/%CPU, and COMMAND.

Services and systemd

A service (or daemon) is a long-running background process, the SSH server (sshd), the web server (nginx), the database (mysqld). On modern Linux they are managed by systemd, the init system. systemd is PID 1: the first process the kernel starts, and the ancestor of every other process.

systemd describes each service as a unit (a .service file). You control them with systemctl:

systemctl status ssh       # is it running? since when? what PID?
systemctl list-units       # everything systemd is managing
systemctl start  nginx     # start now
systemctl enable nginx     # start automatically at boot
journalctl -u ssh          # that service's logs

The boot-to-login chain

How a Linux box gets from power-on to a login prompt:

Firmware (BIOS/UEFI)  ->  Bootloader (GRUB)  ->  Kernel  ->  systemd (PID 1)  ->  services + targets  ->  login

1. Firmware (UEFI/BIOS) powers up the hardware and finds a boot device.
2. The bootloader (GRUB) loads the kernel into memory.
3. The kernel initialises hardware, then starts the first process, systemd (PID 1).
4. systemd brings up the configured services and reaches a target (e.g. graphical or multi-user).
5. You get a login prompt. From login onward, every process you start is a child of systemd.

Where software comes from

You rarely download installers on Linux. Software comes from package managers pulling signed packages from repositories:

• apt , Debian and Ubuntu. Sources live in /etc/apt/sources.list.
• dnf (older: yum) , Fedora and RHEL.

apt update                 # refresh the index of what's available (NOT install)
apt upgrade                # install the newer versions
apt install nginx          # install a package and its dependencies
apt list --installed       # what's already here

apt update only refreshes the list; apt upgrade actually installs the updates. Keeping packages current is the single most important defence against known exploits, an unpatched service is the easiest way in.

Try it (terminal)

1. ps aux , scan the USER and COMMAND columns. Who runs nginx? mysqld?
2. systemctl status ssh and systemctl list-units , the map of running services.
3. apt update , watch it refresh the index (it doesn't install anything).
4. free and uname -a , memory and kernel version (the kernel version hints at patch level).

Why this matters

ps aux plus systemctl list-units is your map of what is running and why, the services a tester probes. The package manager and kernel version tell you how current the box is, which is often where the way in hides.