[Hypothetical] Inheriting a Network - What Server Does What?

[JRA]

Hi Linux ppl.

 

Just wondering if there was an easy answer to the following (hypothetical and fictional) scenario.

 

Say you inherited a mostly Linux network. Windows domain, W7 clients but Linux file servers, virtualisation, DNS/DHCP and all manner of bits of mail relay, captive portal things, imaging etc. In this scenario, all the previous IT staff were killed in a paintballing accident or something, so there's no previous staff to ask things of. Nothing much by way of documentation either, but you know the admin and root passwords. Servers have no real clues in their names, they're all called 'server1', 'server2' etc.

 

How do you figure out what server does what and has what installed on it? Sure you can use dpkg etc to figure out what packages are there, and get back a list of millions of packages, but how do you determine what's 'live'? Is there somewhere something like Add/Remove Programs where you can 'see' what's on?

 

Thanks all.

[Markopolo]

Hi,

 

I'd start with

 

ps -ef | less

To show the running processes

 

 

netstat --protocol=ip -nlp

To see open ports

 

If you are using newer Centos, Fedora Redhat you can use systemctl to find running/enabled services.

 

man systemctl

 

Edit: here is a useful link

 

Hope this helps.

Edited October 19, 2016 by Markopolo

[ItsOggy]

In this case I would start from the W7 client logged in as admin:

 

ipconfig /all

 

Will give you the servers hosting DNS and DHCP as well as the gateway IP hosting your captive portal.

 

Install RSAT on W7 and start looking at the AD, this can find the DC's and then look for GPO or Login scripts to indicate where the Home Directories live.

 

Then browse each server via \\server and look at shares or printers etc.

 

Even with the Linux boxes hosting windows based services this will give you a fairly quick overview.

 

As for mail etc, I presume looking at how a user gets to there email would hold most clues.

 

Finally...

 

Start to document like the last lot should have!

[CAWJames]

The 'history' command is also your friend, it will list the last 1000 command line entries, so you may get an idea what the last admin was doing before the night of the long paint

[TechMonkey]

I'm assuming turning them off one by one and seeing what falls over and who screams isn't an option?....

 

On a more helpful note get into DNS may help if services have been given proper URLs or friendly names. At least you will be able to see all the registered Devices and they may have helpful names. Or they may be named after Simpsons characters at which point you're in for fun.

Edited October 26, 2016 by TechMonkey

[JRA]

Haha, and thanks all.

 

So there's really no simple catch-all way to do that then?

 

I'm going to make sure mine have summaries documented in case I fall into a mincer etc.

[soapyfish]

I would also use nmap too to map out services that are being offered on differing parts of the network