I would guess that some applications, or services are running, and that is what you are seeing.
For example, apache may be running as root, or may be running as...whoever Bind may be running as something. someone else Cheers JM -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: 25 January 2002 21:43 To: [EMAIL PROTECTED] Subject: hidden users? Hi all, I am admnistrating a few machines at my university and sometimes, i got weird results on commands such as 'who' 'w' and 'finger', they tell me that there's more than one user logged in, but the only login i really see is mine, only the finger shows me name of the other user, which supposedly is logged in (or not). this isn't the first time that happens and doesn't happen all the time, but the worse thing is that the user which the 'finger' command outputs as logged in has no shell, actually only root has sshd, and no ftp, mail, etc, is allowed to other users. has anyone passed the same situation i am passing by? tia, SecurityNewbie.
