Identify a system you have been handed

short · 15 min · Objective 1.1

Task

You have SSH access to a machine and nothing else. Establish which distribution family it belongs to, which release, which architecture, and therefore which package manager and which security framework it uses. This is the first thing you do on any unfamiliar host, and doing it from memory rather than from the machine is how people run apt commands on RHEL for ten minutes.

Steps

  1. Read /etc/os-release, which every modern distribution provides. Note the ID, VERSION_ID and ID_LIKE fields; ID_LIKE is what tells you the family for a derivative you have never heard of.
  2. Confirm the architecture with uname -m, and note whether it reports x86_64 or aarch64.
  3. Determine the package manager empirically rather than by assumption: command -v dnf apt rpm dpkg zypper pacman and see what answers.
  4. Ask which mandatory access control framework is active. getenforce answers on SELinux systems; aa-status answers on AppArmor systems. One of them will fail, and that failure is information.
  5. Read the default filesystem type of the root mount with findmnt -n -o FSTYPE /, and check it against what you would expect for that family.

Verify

. /etc/os-release && printf '%s %s (family: %s)\n' "$ID" "$VERSION_ID" "${ID_LIKE:-$ID}"
uname -m
command -v dnf apt >/dev/null 2>&1; command -v dnf || command -v apt
findmnt -n -o FSTYPE /

You should be able to state, in one sentence and without guessing: the family, the release, the architecture, the package manager and the MAC framework. If any of the five came from an assumption rather than from output, go back.

Notes

ID_LIKE is the field worth remembering. A machine reporting ID=rocky with ID_LIKE="rhel centos fedora" tells you everything about which commands will work, even if you have never used Rocky.