root]# w
3:08am up 3 days, 10:49, 2 users, load average: 0.01, 0.04, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
lmax pts/2 a2*****.upc-a.ch 9:27pm 0.00s 0.11s 0.01s w
How it this possible. The user listed is me. But how can ther be two users logged in. Top is also showing two users.
The system is linux redhat 7.2
clocker1996
12-07-2001, 02:38 AM
type who
type /sbin/fuser -v 21/tcp
and then type users
paste all 3 outputs
bobcares
12-07-2001, 05:01 AM
Somebody else is logged in to your computer.
First change the password.
Then see how he got in. This is the time the logs really help...
Have a great day :)
regards
amar
mkaufman
12-07-2001, 07:50 AM
The extra users may be from a program you setup, such as Apache, MySQL, etc..
windchill
12-07-2001, 09:15 AM
It may also be a stale user from an aborted ssh/telnet connection...
Marc
Yes, it was a stale user. How can i kill this user?? IT doesn't have a process name or something?!?!
windchill
12-07-2001, 11:31 AM
you don't have to kill the user.
do a 'ps -aux | grep bash'
You should see two entries. One is you logged in, and one is the stale user's bash (Shell).
Now check the time, since when these users have been running bash and kill the PID of the 'older' bash.
Use this: 'kill -9 12345' (bash's PID)
But be cautious which process id you kill!
Skeptical
12-07-2001, 11:33 AM
Originally posted by windchill
It may also be a stale user from an aborted ssh/telnet connection...
Marc
Exactly what I was thinking. I get that all the time!
cbaker17
12-07-2001, 12:14 PM
Dont forget it could be a hedious hacker intent on using your linux box as a launching pad for his nuclear arsenal which he plans to use to take over the world.
And you said terrorist arent smart..
Linux... If your not running your nuclear site from it, your enemy is.
