LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Find the sockets being used by a process (as a non-root user) (https://www.linuxquestions.org/questions/linux-networking-3/find-the-sockets-being-used-by-a-process-as-a-non-root-user-4175431153/)

Nachete 10-08-2012 11:11 AM

Find the sockets being used by a process (as a non-root user)
 
I have to find the sockets being used by any running process on the system. I can't install external libraries or apps in order to get that information.

I tried with netstat -a -p, fuser lsof -i and ss -p, and all of them work fine... but only if I run them as root, and I should be logged in as a non-root user. In that case, I get the sockets, but not them owner processes. Also, if I use netstat to get the local port of every socket, and then I do fuser -n tcp [lcl_port], I don't get any information (of course, unless I am root).

I tried running those commands as a non-root user in privileged mode: bash -c - p netstat -a -p, bash -c -p fuser -n tcp [lcl_port], bash -c -p lsof -i and bash -c -p ss -p. But I get similar results.

I also tried accessing the /proc/net directory, doing something like cat /proc/[PID]/net/tcp, but it seems to return exactly the same info for any PID, so it isn't really useful for me.

By the way, if I am not logged in as root, I can't redirect the output of lsof -i to the input of grep command. By example, if I type something like lsof -i | grep firefox, I get this message:

Quote:

can't stat() fuse.gvfs-fuse-daemon file system /root/.gvfs
Output information may be incomplete.
How can I find the sockets being currently used by running processes as a non-root user?

Thanks in advance.

nini09 10-08-2012 02:21 PM

If not run as root, you will only see the names of PID you own. The root user is super user. It can see other user information. You can use "sudo" prefix to upgrade current user to root.

propofol 10-08-2012 04:59 PM

Another option similar to 'sudo' is to use 'super'. Add the commands to /etc/super.tab:

Code:

:define SuperUsers user

checkport  'netstat -a -p'              uid=root $SuperUsers

Run by entering:
super checkport

Regards,
Stefan

techguru666 10-08-2012 10:18 PM

Check various usages of netstat command:
http://www.expertslogin.com/tip-for-...riant-outputs/

Nachete 10-10-2012 04:11 PM

Thanks to everyone, but I still can't solve the problem.
I have to get the information through a Bash script that should be executed by a non-root user. The script verifies if there are any open TCP/UDP sockets owned by current user's processes; if this is true, it kills those processes.
So, I only need to find the current user's sockets and their associated processes. It's supposed that I could easily get that information just by doing lsof -i logged in as a "normal" user. So, in order to try the command, I open a socket through establishing a connection from another PC, doing this:

Quote:

ssh nachete@192.168.x.x 'while true; do sleep 2; echo $RANDOM; done'
Then, from my main PC, logged in as root, I check the current sockets for nachete:

Quote:

root@utnso-vm:~# lsof -i | awk '$3 == "nachete" {print $0}'
sshd 5834 nachete 3u IPv4 23609 0t0 TCP utnso-vm.local:ssh->192.168.1.37:35753 (ESTABLISHED)
It finds the socket! However, when I do the same logged in as nachete:

Quote:

nachete@utnso-vm:~$ lsof -i | awk '$3 == "nachete" {print $0}'
nachete@utnso-vm:~$
... I got nothing.

If I try using netstat -a -e -p, it recognizes the nachete sockets as sockets owned by root:

Quote:

root@utnso-vm:~# netstat -a -e -p | grep 23609
tcp 0 0 utnso-vm.local:ssh 192.168.1.37:35753 ESTABLECIDO root 23609 5711/sshd: utnso
Because of that, if I look for nachete sockets using this command, I got nothing:

Quote:

root@utnso-vm:~# netstat -a -e -p | awk '$7 == "nachete" {print $0}'
root@utnso-vm:~#
(in both computers, the hostname is utnso-vm; the username on the second PC is utnso)

It's not allowed to me to use the super command, so I need a way to obtain the information I want without doing that. Anyone knows?

unSpawn 10-10-2012 07:38 PM

Unfortunately in your case repeating the question does not change the answer.

Nachete 10-14-2012 09:34 AM

I think I solved my problem. The error was in the way I was testing my script. Apparently, when you establish a connection through SSH, the client host creates a socket as owned by the current user, but the server creates a socket as owned by root. I was running the ssh command from a host and trying to find the sockets from the other one (using netstat, lsof -i, etc.). That's why I couldn't find any socket unless I was root.
Finally, I ran lsof -i on the same host I had established the connection from, logged in as a non-root user, and it found a socket associated to the ssh process, owned by that user.
Thanks again and sorry for my english.

unSpawn 10-14-2012 10:00 AM

Maybe your wording threw us off (after all you went from "find the sockets being used by any running process (..) logged in as a non-root user" to "sockets owned by current user's processes") but it's good to see you found what you need.


All times are GMT -5. The time now is 03:25 AM.