Ghost User on tty1

jlamothe · 07-31-2008, 08:46 AM

For some reason, I'm still seeing myself logged into tty1 even though I know that's not the case. (I am currently logged in remotely through pts/1.)

Code:

$ finger
Login     Name               Tty      Idle  Login Time   Office     Office Phone
jlamothe  Jonathan Lamothe   pts/1          Jul 31 06:46 (70.54.213.42)
jlamothe  Jonathan Lamothe  *tty1     3:31  Jul 28 21:58

I've made sure to kill all the processes attached to that terminal, but the problem persists.

Code:

$ ps ux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
jlamothe 12161  0.0  0.1   7116  2104 ?        S    06:46   0:01 sshd: jlamothe@
jlamothe 12164  0.0  0.1   3620  2000 pts/1    Ss   06:46   0:00 -bash
jlamothe 12224  0.0  0.0   4544  1672 ?        Ss   07:19   0:00 imapd
jlamothe 12334  0.0  0.0   2564   932 pts/1    R+   09:41   0:00 ps ux

Any ideas how I can fix this? I know a reboot will clear it as it's happened before, but I don't want to resort to that if I don't have to.

jlamothe · 07-31-2008, 08:49 AM

I forgot to mention, I'm running a fresh install of Slack 12.1.

trickykid · 07-31-2008, 09:24 AM

What does who display? Did you happen to login and then startx from the console?

jlamothe · 07-31-2008, 09:37 AM

Code:

$ who
jlamothe pts/1        2008-07-31 06:46 (70.54.213.42)

I'm just using the console, no X. The firewall here won't let me do that.

trickykid · 07-31-2008, 09:53 AM

Quote:

Originally Posted by jlamothe

Code:

$ who
jlamothe pts/1        2008-07-31 06:46 (70.54.213.42)

I'm just using the console, no X. The firewall here won't let me do that.

Who only displays one person logged in. I disable finger and consider it a security risk as you can see who's logged in from a remote location.

jlamothe · 07-31-2008, 10:37 AM

Yes, but finger still displays the same...

It's also set to only answer queries locally (which is the default behaviour). I fail to see the security risk in that.

trickykid · 07-31-2008, 01:43 PM

Quote:

Originally Posted by jlamothe

Yes, but finger still displays the same...

It's also set to only answer queries locally (which is the default behaviour). I fail to see the security risk in that.

Well, clearly finger is still hung up on a login from July 28 that doesn't exist any longer. who is accurate as you said, use who instead of finger would be my solution.

jlamothe · 08-01-2008, 06:52 AM

Yeah. That's pretty much what I decided to do. Plus I rebooted to clear it since top was reading 2 users as well (I use top quite a bit).

It's not like it's a big problem, just annoying.