From owner-freebsd-questions@FreeBSD.ORG Thu Dec 16 18:21:37 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4CA8516A4CE for ; Thu, 16 Dec 2004 18:21:37 +0000 (GMT) Received: from orchid.homeunix.org (awn180.neoplus.adsl.tpnet.pl [83.27.73.180]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1A0A943D31 for ; Thu, 16 Dec 2004 18:21:36 +0000 (GMT) (envelope-from freebsd@orchid.homeunix.org) Received: from [192.168.1.66] (blackacidevil.orchid.homeunix.org [192.168.1.66]) (authenticated bits=0) by orchid.homeunix.org (8.13.1/8.13.1) with ESMTP id iBGILUGS097356 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 16 Dec 2004 19:21:38 +0100 (CET) (envelope-from freebsd@orchid.homeunix.org) Message-ID: <41C1D214.6080605@orchid.homeunix.org> Date: Thu, 16 Dec 2004 19:21:08 +0100 From: Karol Kwiatkowski User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Brandon Lodriguss References: In-Reply-To: X-Enigmail-Version: 0.89.5.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.80/614/Wed Dec 1 16:44:43 2004 clamav-milter version 0.80j on orchid.homeunix.org X-Virus-Status: Clean cc: freebsd-questions@freebsd.org Subject: Re: user disappears from w and who X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd@orchid.homeunix.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2004 18:21:37 -0000 Brandon Lodriguss wrote: > Hello, > > I'm wondering if anyone else has witnessed this phenomenon in FreeBSD > 5.3-Release who could perhaps tell me if it's an oddity/configuration > error with my system, or a problem with this version. I had a 4.10 > box that this does not happen on, similarly configured. > > The steps to reproduce the problem: > Log in via ssh. > Type login, log in again to a second shell within your existing shell. > Type w or who. At this point, no IP or hostname should be listed for > you, and you only show up once. This is normal behavior, and has > happened in all versions of fbsd since i can remember. > Type exit to return to your original shell. > Do a w or who now... > > At this point on my system, you are no longer listed in w or who, and > the user count in w is incorrect. The only indication that you are > still logged in is an active sshd process/connection. If you type > last , it does not say "still logged in...". You can, > however, snoop on the original tty as root using the watch command, > even if the user is invisible (provided you noticed what tty the user > was assigned before he went invisible.) [snip] > Has anyone seen this behavior before? Did I misconfigure something? Hello, although I don't have an answer to this, I can confirm this happening here, too (5.3-RELEASE-p2, ssh session): > login as: joe > Password: > Last login: Thu Dec 16 18:31:36 2004 > [...snip...] > > joe$ who > joe ttyp1 Dec 16 18:46 (192.168.1.66) > > joe$ w > 6:41PM up 12 days, 3:18, 1 user, load averages: 0.26, 0.15, 0.10 > USER TTY FROM LOGIN@ IDLE WHAT > joe p1 name.of.a.box 6:41PM - w > joe$ login > login: joe > Last login: Thu Dec 16 18:41:26 from name.of.a.box > [...snip...] > joe$ w > 6:43PM up 12 days, 3:20, 1 user, load averages: 0.05, 0.10, 0.08 > USER TTY FROM LOGIN@ IDLE WHAT > joe p1 - 6:42PM - w > joe$ who > joe ttyp1 Dec 16 18:42 and now: > joe$ exit > joe$ w > 6:44PM up 12 days, 3:21, 0 users, load averages: 0.07, 0.10, 0.08 > USER TTY FROM LOGIN@ IDLE WHAT > joe$ who > joe$ and as root (right after): > joe$ su > Password: > Yes, Master? w > 7:06PM up 12 days, 3:43, 0 users, load averages: 0.08, 0.09, 0.08 > USER TTY FROM LOGIN@ IDLE WHAT > Yes, Master? who > Yes, Master? sockstat -4 | grep joe > joe sshd 91554 6 tcp4 192.168.1.1:22 192.168.1.66:1458 > Yes, Master? ps aux | grep sshd | grep joe > root 91551 0.0 2.0 6400 1812 ?? Is 11:52AM 0:00.10 sshd: joe [priv] (sshd) > joe 91554 0.0 2.1 6408 1916 ?? S 11:53AM 0:03.68 sshd: joe@ttyp0 (sshd) last(1): > Yes, Master? last joe > joe ttyp1 192.168.1.66 Thu Dec 16 18:46 - 18:51 (00:05) > Yes, Master? date > Thu Dec 16 19:15:25 CET 2004 > Yes, Master? uname -r > 5.3-RELEASE-p2 I can then make another ssh session to the box and that user is not listed either. Regards, Karol -- Karol Kwiatkowski