five terminal commands that feel illegal to know

save this one before you forget

every os ships with a handful of commands that feel like they shouldn't be free. they're not secret, they're not "hacking," they're just built in tools that show you what your own machine has been doing behind your back. the reason they feel illegal is because most people never look. here's five, what they reveal, and how to use that same info to lock your own stuff down.

1. who's actually been logging into this machine

this one shows login history, including remote logins you might not remember approving.

last

it lists every login session, the username, where it came from, and how long they stayed logged in. on a shared computer or a server you manage, this is the first place to check if something feels off. a login at 3am from an ip you don't recognize is not a vibe, it's a red flag.

defend it: run this monthly on anything with remote access. if you see logins you can't account for, change the password immediately and check if ssh key auth is enabled instead of password auth, since keys are much harder to brute force.

2. what your computer is quietly talking to

your machine has open connections to the internet right now, and most of them you never approved by name.

lsof -i

this lists every process with an active network connection, the program name, and the port it's using. it's how people find out that some random app they installed two years ago is still phoning home in the background.

defend it: if you see a process you don't recognize with an open connection, look up the process name before you panic, but don't ignore it either. uninstall anything you don't use, and firewall off outbound traffic for apps that have no business reaching the internet.

3. everything you've typed, still sitting there

your shell remembers. all of it. including that one time you pasted a password into a command by accident.

history

this dumps your command history, sometimes hundreds or thousands of lines back, stored in a plain text file like .bash_history or .zsh_history. anyone with access to your user account can read that file cold.

defend it: never type secrets directly into a command. use environment variables or a secrets manager instead. and if you ever did paste something sensitive, clear it with history -c and manually delete the history file, because clearing the session doesn't always wipe the file on disk.

4. every device quietly sharing your network

your router isn't the only thing that knows what's connected. your own laptop keeps a local map too.

arp -a

this shows every device your machine has recently talked to on the local network, mac addresses included. it's a fast way to spot a device you don't recognize sitting on your home wifi.

defend it: cross check the list against your router's connected devices page. anything unfamiliar means it's time to change your wifi password, turn off wps, and make sure you're not still running an old default admin login on the router itself.

5. what's actually running under the hood right now

this is the one that makes people uncomfortable, because it shows everything, including stuff running silently with no window open.

ps aux

it lists every active process on the system, who's running it, and how much cpu and memory it's eating. this is exactly how people find hidden miners, keyloggers, or monitoring software they didn't install themselves.

defend it: scan the list for processes with random looking names or ones eating resources for no reason. if something looks wrong, look it up before killing it, and if it turns out to be malicious, disconnect from the network first, then remove it.

the takeaway

none of this is exotic. it's your own system, answering honestly when you finally ask it a question. run these on your own machines on purpose, not just when something already feels wrong. the whole point of knowing this stuff is catching problems before they become breaches, not after. save the post, run the five, and actually look at what comes back.