user disappears from w and who

[Karol Kwiatkowski]

Brandon Lodriguss wrote:
> Hello,
> 
> I'm wondering if anyone else has witnessed this phenomenon in FreeBSD
> 5.3-Release who could perhaps tell me if it's an oddity/configuration
> error with my system, or a problem with this version.  I had a 4.10
> box that this does not happen on, similarly configured.
> 
> The steps to reproduce the problem:
> Log in via ssh.
> Type login, log in again to a second shell within your existing shell.
> Type w or who.  At this point, no IP or hostname should be listed for
> you, and you only show up once.  This is normal behavior, and has
> happened in all versions of fbsd since i can remember.
> Type exit to return to your original shell.
> Do a w or who now...
> 
> At this point on my system, you are no longer listed in w or who, and
> the user count in w is incorrect.  The only indication that you are
> still logged in is an active sshd process/connection.  If you type
> last <username>, it does not say "still logged in...".  You can,
> however, snoop on the original tty as root using the watch command,
> even if the user is invisible (provided you noticed what tty the user
> was assigned before he went invisible.)
[snip]
> Has anyone seen this behavior before?  Did I misconfigure something?

Hello,

although I don't have an answer to this, I can confirm this happening
here, too (5.3-RELEASE-p2, ssh session):

> login as: joe
> Password:
> Last login: Thu Dec 16 18:31:36 2004
> [...snip...]
> 
> joe$ who
> joe            ttyp1    Dec 16 18:46 (192.168.1.66)
>  
> joe$ w
>  6:41PM  up 12 days,  3:18, 1 user, load averages: 0.26, 0.15, 0.10
> USER             TTY      FROM              LOGIN@  IDLE WHAT
> joe              p1       name.of.a.box     6:41PM     - w
> joe$ login
> login: joe
> Last login: Thu Dec 16 18:41:26 from name.of.a.box
> [...snip...]
> joe$ w
>  6:43PM  up 12 days,  3:20, 1 user, load averages: 0.05, 0.10, 0.08
> USER             TTY      FROM              LOGIN@  IDLE WHAT
> joe              p1       -                 6:42PM     - w
> joe$ who
> joe            ttyp1    Dec 16 18:42

and now:
> joe$ exit
> joe$ w
>  6:44PM  up 12 days,  3:21, 0 users, load averages: 0.07, 0.10, 0.08
> USER             TTY      FROM              LOGIN@  IDLE WHAT
> joe$ who
> joe$

and as root (right after):
> joe$ su
> Password:
> Yes, Master? w
>  7:06PM  up 12 days,  3:43, 0 users, load averages: 0.08, 0.09, 0.08
> USER             TTY      FROM              LOGIN@  IDLE WHAT
> Yes, Master? who
> Yes, Master? sockstat -4 | grep joe
> joe      sshd       91554 6  tcp4   192.168.1.1:22       192.168.1.66:1458
> Yes, Master? ps aux | grep sshd | grep joe
> root    91551  0.0  2.0  6400 1812  ??  Is   11:52AM   0:00.10 sshd: joe [priv] (sshd)
> joe     91554  0.0  2.1  6408 1916  ??  S    11:53AM   0:03.68 sshd: joe at ttyp0 (sshd)

last(1):
> Yes, Master? last joe
> joe              ttyp1    192.168.1.66     Thu Dec 16 18:46 - 18:51  (00:05)
> Yes, Master? date
> Thu Dec 16 19:15:25 CET 2004

> Yes, Master? uname -r
> 5.3-RELEASE-p2


I can then make another ssh session to the box and that user is not
listed either.

Regards,
Karol

-- 
Karol Kwiatkowski  <freebsd at orchid dot homeunix dot org>