From owner-freebsd-questions@FreeBSD.ORG Tue Jun 24 07:46:36 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0DBFA37B401 for ; Tue, 24 Jun 2003 07:46:36 -0700 (PDT) Received: from ensim1.kuruption.net (kuruption.net [64.246.28.125]) by mx1.FreeBSD.org (Postfix) with ESMTP id 15FF343FCB for ; Tue, 24 Jun 2003 07:46:35 -0700 (PDT) (envelope-from raymond@sundland.com) Received: from kuruption.net (pcp03026213pcs.plnfld01.nj.comcast.net [68.85.62.182]) by ensim1.kuruption.net (8.11.6/8.11.6) with ESMTP id h5OEkYR09926 for ; Tue, 24 Jun 2003 10:46:34 -0400 Received: by kuruption.net (Postfix, from userid 50) id 8B8588D9CC; Tue, 24 Jun 2003 10:46:27 -0400 (EDT) Received: from sundland.com (ensim1.kuruption.net [64.246.28.125]) by kuruption.net (Postfix) with ESMTP id B265D8D9C8 for ; Tue, 24 Jun 2003 10:46:25 -0400 (EDT) Message-ID: <3EF86369.3080606@sundland.com> Date: Tue, 24 Jun 2003 10:42:49 -0400 From: Raymond Sundland User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3.1) Gecko/20030425 X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-questions@freebsd.org X-Enigmail-Version: 0.73.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-0.5 required=5.0 tests=SPAM_PHRASE_00_01,USER_AGENT,USER_AGENT_MOZILLA_UA, X_ACCEPT_LANG version=2.44 X-Spam-Level: Subject: Possible bug in 5.1 - su / utmp X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jun 2003 14:46:36 -0000 I found this very interesting when I saw it originally, but then found it was probably a bug. Basically, when I log into my 5.1-RELEASE box (compiled today from CVS), I can do a 'w' and get the following: % w 10:39AM up 5:01, 1 user, load averages: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE WHAT ray p0 somehost 10:39AM - w Now, when I try to SU to root, this entry changes: % su - Password: Last login: Tue Jun 24 07:44:19 on ttyp1 % whoami root % w 10:40AM up 5:01, 1 user, load averages: 0.04, 0.01, 0.00 USER TTY FROM LOGIN@ IDLE WHAT root p0 - 10:40AM - w So, it looks like the utmp entry is being made (again) for ttyp0 and recording it. This would be fine from my perspective, but is misleading once I exit the root shell: % exit % whoami ray % w 10:42AM up 5:03, 1 user, load averages: 0.01, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE WHAT root p0 - 10:40AM - w This may be a bug in PAM, since I don't think su calls login (or maybe it does?) Note that this does not happen if I do not use the '-' option for su. This also shows up in the lastlog: root ttyp2 Tue Jun 24 10:40 - 10:43 (00:02) ray ttyp2 somehost Tue Jun 24 10:39 - 10:40 (00:00) Anyone have any information about this... know what the bug is? Maybe it's a setting I have set that can be changed? Thanks.