On Fri, 25 Jan 2002 [EMAIL PROTECTED] wrote:
>
> Hi all,
>
> I am admnistrating a few machines at my university and sometimes, i got weird
>results on commands such as 'who' 'w' and 'finger', they tell me that there's more
>than one user logged in, but the only login i really see is mine, only the finger
>shows me name of the other user, which supposedly is logged in (or not).
> this isn't the first time that happens and doesn't happen all the time, but the
>worse thing is that the user which the 'finger' command outputs as logged in has no
>shell, actually only root has sshd, and no ftp, mail, etc, is allowed to other users.
>
> has anyone passed the same situation i am passing by?
Well, yes.
Could be that some user has lost the connection, and therefore all
processes are sweeped away, but the wtmp record still thinks the user is
logged in. Had it myself on a FreeBSD box, I lost my ssh session due to a
pulled-out network jack, and as connectivity a few minutes later was
re-established, I did not wait until the OS cleans everything up, but
wiped some things myself... well, about two months later the machine
finally discovered that the user was indeed inactive and cleared wtmp.
do a ps auxw and look what happens, then do a last or lastlogin.
HTH
Olaf Hoyer
