Who are these extra users?

  • Follow


re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack laptop.

Who are these extra users?

A few days ago I logged in as root but never logged out, just closed the
terminal windw by accident. Is there any way to logout? I don't see a process
for root (below) but maybe I screwed up? Why am I logged in 3 times?  I know
I can reboot but I don't really want to do that if its not necessary?

With root listed is there a security issue? 

Help!

Thanks,

Al


al@xxx:~$ uptime
 07:09:21  up 41 days, 21:25,  4 users,  load average: 0.12, 0.06, 0.01
al@xxx:~$ who
al       :0           Jun 17 09:38
al       pts/0        Jun 17 09:39
al       pts/1        Jul 29 07:09
al       pts/2        Jul 29 07:13
root     pts/4        Jul 24 09:07



al@xxx:~$ ps -aux | grep "pts/"
al        5776  0.0  0.1  2312 1320 pts/1    S    07:09   0:00 -bash
al        5795  0.0  0.1  2312 1324 pts/2    S    07:13   0:00 -bash
al        5819  0.0  0.0  2840  896 pts/2    R    07:15   0:00 ps -aux

0
Reply no.spam.acanton (73) 7/29/2004 2:21:49 PM

Al C. wrote:
> re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack laptop.
> 
> Who are these extra users?
> 
> A few days ago I logged in as root but never logged out, just closed the
> terminal windw by accident. Is there any way to logout? I don't see a process
> for root (below) but maybe I screwed up? Why am I logged in 3 times?  
[snip]
> al@xxx:~$ who
> al       :0           Jun 17 09:38
> al       pts/0        Jun 17 09:39
> al       pts/1        Jul 29 07:09
> al       pts/2        Jul 29 07:13

Looks to me like you're logged in via xdm/kdm/gdm (or some other 
graphical login;  suggested by the :0 line) with three xterms open (the 
pts lines).
0
Reply jpstewart (2598) 7/29/2004 3:50:51 PM


  "Al C." <no.spam.acanton@adams-blake.no.spam.com>,
  In a message on Thu, 29 Jul 2004 07:21:49 -0700, wrote :

"C> re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack laptop.
"C> 
"C> Who are these extra users?
"C> 
"C> A few days ago I logged in as root but never logged out, just closed the
"C> terminal windw by accident. Is there any way to logout? I don't see a process
"C> for root (below) but maybe I screwed up? Why am I logged in 3 times?  I know
"C> I can reboot but I don't really want to do that if its not necessary?
"C> 
"C> With root listed is there a security issue? 
"C> 
"C> Help!
"C> 
"C> Thanks,
"C> 
"C> Al
"C> 
"C> 
"C> al@xxx:~$ uptime
"C>  07:09:21  up 41 days, 21:25,  4 users,  load average: 0.12, 0.06, 0.01
"C> al@xxx:~$ who
"C> al       :0           Jun 17 09:38
"C> al       pts/0        Jun 17 09:39
"C> al       pts/1        Jul 29 07:09
"C> al       pts/2        Jul 29 07:13
"C> root     pts/4        Jul 24 09:07
"C> 
"C> 
"C> 
"C> al@xxx:~$ ps -aux | grep "pts/"
"C> al        5776  0.0  0.1  2312 1320 pts/1    S    07:09   0:00 -bash
"C> al        5795  0.0  0.1  2312 1324 pts/2    S    07:13   0:00 -bash
"C> al        5819  0.0  0.0  2840  896 pts/2    R    07:15   0:00 ps -aux

'ps -ut pts/4'

should list the process(es) using pts/4, which should include the root
process above.



"C> 
"C>                       

                                     \/
Robert Heller                        ||InterNet:   heller@cs.umass.edu
http://vis-www.cs.umass.edu/~heller  ||            heller@deepsoft.com
http://www.deepsoft.com              /\FidoNet:    1:321/153






                                                                      
0
Reply heller (2930) 7/29/2004 6:58:45 PM

John-Paul Stewart wrote:

> Al C. wrote:
>> re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack
>> laptop.
>> 
>> Who are these extra users?
>> 
>> A few days ago I logged in as root but never logged out, just closed the
>> terminal windw by accident. Is there any way to logout? I don't see a
>> process for root (below) but maybe I screwed up? Why am I logged in 3
>> times?
> [snip]
>> al@xxx:~$ who
>> al       :0           Jun 17 09:38
>> al       pts/0        Jun 17 09:39
>> al       pts/1        Jul 29 07:09
>> al       pts/2        Jul 29 07:13
> 
> Looks to me like you're logged in via xdm/kdm/gdm (or some other
> graphical login;  suggested by the :0 line) with three xterms open (the
> pts lines).

I use KDE and I always log in with the kdm. Where did the 3 xterms come from?

Do I need to get rid of these terminals? If so, how?


> 'ps -ut pts/4'
> 
> should list the process(es) using pts/4, which should include the root
> process above.
> 

I get this:

al@xxxx:~$ ps -ut pts/4
ps: error: User name does not exist.
usage: ps -[Unix98 options]
       ps [BSD-style options]
       ps --[GNU-style long options]
       ps --help for a command summary

Thanks, 
Al

0
Reply no.spam.acanton (73) 7/29/2004 7:31:37 PM

>>>>> "Al" == Al C <no.spam.acanton@adams-blake.no.spam.com> writes:

    Al> A few days ago I logged in as root but never logged out, just
    Al> closed the terminal windw by accident.

Then, the shell  process in the window dies,  because the terminal has
died.


    Al> Is there any way to logout?

Destroying a terminal will cause the interactive shell process to die.
So, it has already been logged out, though not normally.  :)


    Al> I don't see a process for root (below) but maybe I screwed
    Al> up? Why am I logged in 3 times?  

Are you  sure the terminal  processes have really died?   It's strange
that  interactive  shell processes  continue  to  run  even after  the
terminal has died.



    Al> I know I can reboot but I don't really want to do that if its
    Al> not necessary?

You don't need to worry  about those processes.  They just sleep there
occupying a little  bit virtual memory.  Unless memory  is tight, they
shouldn't cause problems.


    Al> With root listed is there a security issue?

It  could be.   Why don't  you  'kill' them?   Use 'kill  -9' if  they
survive  a normal  'kill'.  But  please  first make  sure they're  not
processes spawned by cron to run some housekeeping shell-scripts.



-- 
Lee Sau Dan                     +Z05biGVm-                          ~{@nJX6X~}

E-mail: danlee@informatik.uni-freiburg.de
Home page: http://www.informatik.uni-freiburg.de/~danlee
0
Reply danlee (1494) 7/29/2004 8:05:24 PM

Al C. wrote:
> John-Paul Stewart wrote:
> 
> 
>>Al C. wrote:
>>
>>>re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack
>>>laptop.
>>>
>>>Who are these extra users?
>>>
>>>A few days ago I logged in as root but never logged out, just closed the
>>>terminal windw by accident. Is there any way to logout? I don't see a
>>>process for root (below) but maybe I screwed up? Why am I logged in 3
>>>times?
>>
>>[snip]
>>
>>>al@xxx:~$ who
>>>al       :0           Jun 17 09:38
>>>al       pts/0        Jun 17 09:39
>>>al       pts/1        Jul 29 07:09
>>>al       pts/2        Jul 29 07:13
>>
>>Looks to me like you're logged in via xdm/kdm/gdm (or some other
>>graphical login;  suggested by the :0 line) with three xterms open (the
>>pts lines).
> 
> 
> I use KDE and I always log in with the kdm. Where did the 3 xterms come from?

The three xterms (or three Konsole windows, or any three command-prompt 
windows) is just a guess as to what is using those pts.  If you don't 
have windows open with command prompts, then you'll need to look into it 
further.

> Do I need to get rid of these terminals? If so, how?

Depends.  If you have the windows open, then simply closing them will 
get rid of the entries for the pts.  (But if you have the windows open, 
they're probably open for a reason!)  If you don't have command prompt 
windows open, then my initial guess was wrong.  In that case, 'lsof 
/dev/pts/0' will tell what is causing the pts/0 line (and so on).
0
Reply jpstewart (2598) 7/29/2004 9:20:54 PM

John-Paul Stewart wrote:

> Al C. wrote:
>> John-Paul Stewart wrote:
>> 
>> 
>>>Al C. wrote:
>>>
>>>>re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack
>>>>laptop.
>>>>
>>>>Who are these extra users?
>>>>
>>>>A few days ago I logged in as root but never logged out, just closed the
>>>>terminal windw by accident. Is there any way to logout? I don't see a
>>>>process for root (below) but maybe I screwed up? Why am I logged in 3
>>>>times?
>>>
>>>[snip]
>>>
>>>>al@xxx:~$ who
>>>>al       :0           Jun 17 09:38
>>>>al       pts/0        Jun 17 09:39
>>>>al       pts/1        Jul 29 07:09
>>>>al       pts/2        Jul 29 07:13
>>>
>>>Looks to me like you're logged in via xdm/kdm/gdm (or some other
>>>graphical login;  suggested by the :0 line) with three xterms open (the
>>>pts lines).
>> 
>> 
>> I use KDE and I always log in with the kdm. Where did the 3 xterms come
>> from?
> 
> The three xterms (or three Konsole windows, or any three command-prompt
> windows) is just a guess as to what is using those pts.  If you don't
> have windows open with command prompts, then you'll need to look into it
> further.
> 
>> Do I need to get rid of these terminals? If so, how?
> 
> Depends.  If you have the windows open, then simply closing them will
> get rid of the entries for the pts.  (But if you have the windows open,
> they're probably open for a reason!)  If you don't have command prompt
> windows open, then my initial guess was wrong.  In that case, 'lsof
> /dev/pts/0' will tell what is causing the pts/0 line (and so on).

Is it possible that the these extra users are dead processes?

al@darkstar:~$ who -ad
                        Jun 17 09:38                12 id=si    term=0 exit=0
           system boot  Jun 17 09:38
           run-level 4  Jun 17 09:38                   last=S
                        Jun 17 09:38                43 id=rc    term=0 exit=0
LOGIN      tty6         Jun 17 09:38              2089 id=c6
                        Jun 17 09:38              2090 id=x1
al       ? :0           Jun 17 09:38   ?          2093
al       + pts/0        Jun 17 09:39  old         2181
al       - pts/1        Jul 29 19:00   .          8234
           pts/2        Jul 29 07:21              5794 id=/2    term=0 exit=0
           pts/3        Jul  3 14:34             12238 id=/3    term=0 exit=0
root     ? pts/4        Jul 24 09:07   ?         20517
           pts/2        Jul 27 00:29             30164 id=ts/2  term=0 exit=0
           pts/1        Jul 27 09:37             31427 id=ts/1  term=0 exit=0


When I try the lsof command I get the following
lsof /dev/pts/*
COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAME
kdeinit 2181   al   10u   CHR  136,0         2 /dev/pts/0
bash    8234   al    0u   CHR  136,1         3 /dev/pts/1
bash    8234   al    1u   CHR  136,1         3 /dev/pts/1
bash    8234   al    2u   CHR  136,1         3 /dev/pts/1
bash    8234   al  255u   CHR  136,1         3 /dev/pts/1
lsof    8250   al    0u   CHR  136,1         3 /dev/pts/1
lsof    8250   al    1u   CHR  136,1         3 /dev/pts/1
lsof    8250   al    2u   CHR  136,1         3 /dev/pts/1


All I have open is one terminal, Knode and Kmail. I'm confused as hell. Maybe
I should just re-boot? There has to be a way of getting rid of them.

al@darkstar:~$ who
al       :0           Jun 17 09:38
al       pts/0        Jun 17 09:39
al       pts/1        Jul 29 19:00
root     pts/4        Jul 24 09:07


Thanks,

Al


0
Reply no.spam.acanton (73) 7/30/2004 3:14:40 AM

On Thu, 29 Jul 2004 20:14:40 -0700, Al C. <no.spam.acanton@adams-blake.no.spam.com> wrote:

> John-Paul Stewart wrote:
>
>> Al C. wrote:
>>> John-Paul Stewart wrote:
>>>
>>>
>>>> Al C. wrote:
>>>>
>>>>> re: Slack 9.1, KDE 3.14, on router sharing DSL line with wife's Slack
>>>>> laptop.
>>>>>
>>>>> Who are these extra users?
>>>>>
>>>>> A few days ago I logged in as root but never logged out, just closed the
>>>>> terminal windw by accident. Is there any way to logout? I don't see a
>>>>> process for root (below) but maybe I screwed up? Why am I logged in 3
>>>>> times?
>>>>
>>>> [snip]
>>>>
>>>>> al@xxx:~$ who
>>>>> al       :0           Jun 17 09:38
>>>>> al       pts/0        Jun 17 09:39
>>>>> al       pts/1        Jul 29 07:09
>>>>> al       pts/2        Jul 29 07:13
>>>>
>>>> Looks to me like you're logged in via xdm/kdm/gdm (or some other
>>>> graphical login;  suggested by the :0 line) with three xterms open (the
>>>> pts lines).
>>>
>>>
>>> I use KDE and I always log in with the kdm. Where did the 3 xterms come
>>> from?
>>
>> The three xterms (or three Konsole windows, or any three command-prompt
>> windows) is just a guess as to what is using those pts.  If you don't
>> have windows open with command prompts, then you'll need to look into it
>> further.
>>
>>> Do I need to get rid of these terminals? If so, how?
>>
>> Depends.  If you have the windows open, then simply closing them will
>> get rid of the entries for the pts.  (But if you have the windows open,
>> they're probably open for a reason!)  If you don't have command prompt
>> windows open, then my initial guess was wrong.  In that case, 'lsof
>> /dev/pts/0' will tell what is causing the pts/0 line (and so on).
>
> Is it possible that the these extra users are dead processes?
>
> al@darkstar:~$ who -ad
>                         Jun 17 09:38                12 id=si    term=0 exit=0
>            system boot  Jun 17 09:38
>            run-level 4  Jun 17 09:38                   last=S
>                         Jun 17 09:38                43 id=rc    term=0 exit=0
> LOGIN      tty6         Jun 17 09:38              2089 id=c6
>                         Jun 17 09:38              2090 id=x1
> al       ? :0           Jun 17 09:38   ?          2093
> al       + pts/0        Jun 17 09:39  old         2181
> al       - pts/1        Jul 29 19:00   .          8234
>            pts/2        Jul 29 07:21              5794 id=/2    term=0 exit=0
>            pts/3        Jul  3 14:34             12238 id=/3    term=0 exit=0
> root     ? pts/4        Jul 24 09:07   ?         20517
>            pts/2        Jul 27 00:29             30164 id=ts/2  term=0 exit=0
>            pts/1        Jul 27 09:37             31427 id=ts/1  term=0 exit=0
>
>
> When I try the lsof command I get the following
> lsof /dev/pts/*
> COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAME
> kdeinit 2181   al   10u   CHR  136,0         2 /dev/pts/0
> bash    8234   al    0u   CHR  136,1         3 /dev/pts/1
> bash    8234   al    1u   CHR  136,1         3 /dev/pts/1
> bash    8234   al    2u   CHR  136,1         3 /dev/pts/1
> bash    8234   al  255u   CHR  136,1         3 /dev/pts/1
> lsof    8250   al    0u   CHR  136,1         3 /dev/pts/1
> lsof    8250   al    1u   CHR  136,1         3 /dev/pts/1
> lsof    8250   al    2u   CHR  136,1         3 /dev/pts/1
>
>
> All I have open is one terminal, Knode and Kmail. I'm confused as hell. Maybe
> I should just re-boot? There has to be a way of getting rid of them.
>
> al@darkstar:~$ who
> al       :0           Jun 17 09:38
> al       pts/0        Jun 17 09:39
> al       pts/1        Jul 29 19:00
> root     pts/4        Jul 24 09:07

Haven't seen any complete ps outputs here, but your lsof says there's a shell on pts/1.
Kill it
    kill -1 8234

Basically, find out what tty you're on with
    tty
Then kill any shells or such on any other tty.
0
Reply joebeanfish (188) 7/30/2004 6:07:00 PM

7 Replies
37 Views

(page loaded in 0.225 seconds)

Similiar Articles:













7/14/2012 8:49:33 AM


Reply: