> I am admnistrating a few machines at my university and sometimes, i got weird >results on commands such as 'who' 'w' and 'finger', they tell me that there's more >than one user logged in, but the only login i really see is mine, only the finger >shows me name of the other user, which supposedly is logged in (or not).
What might be possible is that these users have valid accounts, and when they logged out, that information did not get written to the relevant files in /var/log. Most probably wtmp and lastlog. But in case these are not valid users, then you *might* have a problem at your hands. What OS are you running? Has it been patched properly. What does ps auwx|grep "username" show?? Here "username" is the user you are talking about. Check if the machine has been compomised. But before you panic, remember it is possible that the comp might show a valid user as logged in... even if he has logged out sometime back. This usually occurs if the log file has not been properly updated. Regards, M. --------------------------------------------- In God I Trust -- on all others I use dsniff.
