user disappears from w and who

[Brandon Lodriguss]

Hi,

I still have not found a reason for this happening in this version of fbsd 
but not others.  I am unsure if this is a bug or not.  If anyone has an 
answer or a theory, it would be much appreciated.

I do however have two workarounds if anyone is concerned about their users 
doing this little annoyance.  One is editing /etc/login.access and allowing 
local logins only for yourself, or denying it for a user group.

Another is changing permissions on /usr/bin/login so that only the owner 
(root) and possibly group (wheel) can execute it.  I'm not sure if this 
would have any unintended side effects, but I've seen none so far...

It seems like utmp/wtmp is getting updated when the user logs out of the 
second shell, then it ignores the fact that the user is still logged in to 
the original shell.

Best regards,
Brandon

At 01:21 PM 12/16/2004, you wrote:

>Hello,
>
>although I don't have an answer to this, I can confirm this happening
>here, too (5.3-RELEASE-p2, ssh session):
>
> > login as: joe
> > Password:
> > Last login: Thu Dec 16 18:31:36 2004
> > [...snip...]
> >
> > joe$ who
> > joe            ttyp1    Dec 16 18:46 (192.168.1.66)
> >
> > joe$ w
> >  6:41PM  up 12 days,  3:18, 1 user, load averages: 0.26, 0.15, 0.10
> > USER             TTY      FROM              LOGIN@  IDLE WHAT
> > joe              p1       name.of.a.box     6:41PM     - w
> > joe$ login
> > login: joe
> > Last login: Thu Dec 16 18:41:26 from name.of.a.box
> > [...snip...]
> > joe$ w
> >  6:43PM  up 12 days,  3:20, 1 user, load averages: 0.05, 0.10, 0.08
> > USER             TTY      FROM              LOGIN@  IDLE WHAT
> > joe              p1       -                 6:42PM     - w
> > joe$ who
> > joe            ttyp1    Dec 16 18:42
>
>and now:
> > joe$ exit
> > joe$ w
> >  6:44PM  up 12 days,  3:21, 0 users, load averages: 0.07, 0.10, 0.08
> > USER             TTY      FROM              LOGIN@  IDLE WHAT
> > joe$ who
> > joe$
>
>and as root (right after):
> > joe$ su
> > Password:
> > Yes, Master? w
> >  7:06PM  up 12 days,  3:43, 0 users, load averages: 0.08, 0.09, 0.08
> > USER             TTY      FROM              LOGIN@  IDLE WHAT
> > Yes, Master? who
> > Yes, Master? sockstat -4 | grep joe
> > joe      sshd       91554 6  tcp4   192.168.1.1:22       192.168.1.66:1458
> > Yes, Master? ps aux | grep sshd | grep joe
> > root    91551  0.0  2.0  6400 1812  ??  Is   11:52AM   0:00.10 sshd: 
> joe [priv] (sshd)
> > joe     91554  0.0  2.1  6408 1916  ??  S    11:53AM   0:03.68 sshd: 
> joe at ttyp0 (sshd)
>
>last(1):
> > Yes, Master? last joe
> > joe              ttyp1    192.168.1.66     Thu Dec 16 18:46 - 
> 18:51  (00:05)
> > Yes, Master? date
> > Thu Dec 16 19:15:25 CET 2004
>
> > Yes, Master? uname -r
> > 5.3-RELEASE-p2
>
>
>I can then make another ssh session to the box and that user is not
>listed either.
>
>Regards,
>Karol
>
>--
>Karol Kwiatkowski  <freebsd at orchid dot homeunix dot org>