AIX'ers,

I have an rs/6000 running aix 4.3.3 that is listing stale/not wanted users when I type the command: who

Now, this machine underwent some maintenance earlier today to update the version of secure shell, but I still see users logged in with tty's that seem to be stale.

output from 'who':


user ttype May 22 18:46 (XX.XX.XX.XXX)
user ttypf May 22 18:46 (XX.XX.XX.XXX)
user ttyq0 May 22 18:46 (XX.XX.XX.XXX)
user ttyq1 May 22 18:46 (XX.XX.XX.XXX)


How would I manually boot this user off (assuming i have the root password, which i do)?? I am positive that this user is not in the middle of any activity and I want to avoid rebooting the entire machine for obvious downtime issues.

Thanks!

zepplin611

Try doing a 'ps -ef|grep ksh' (substitute what ever shell you are using for ksh if different). You'll have to weed through the result and get the process ID for their shell. You can then kill the session with a standard 'kill' command. Tack on a -9 if you are really malicious.

thanks loose cannon...

the issue isn't that i can't kill the pid's its that they aren't listed....ps -ef|grep ksh provides no
corresponding pid's for these users...it seems they exist w/o pid's...is this possible?

Run 'top' and look for the number of zombie processes. I've seen this before when a user's session IS a zombie process. If this is the case then the only correction is to reboot the system, or live with it.

enclosed is the output from top:

machine load averages: 0.06, 0.08, 0.06 Sun May 23 16:50:22 2004
Cpu states: 0.0% user, 0.0% system, 0.0% wait, 100.0% idle
Real memory: 4193998.5M used, 305.6M free, 0.1M total
Virtual memory: 204.8M used, 0.0M free, 204.8M total


no-where does it state anything about zombie processes, as top typically does in linux.
It seemingly appears that the login's could be zombie processes...but is there anything I can check to positively identify these as such??
thanks!

Hi
If you know which users you want to kick out , why dont you just run ps -ef|grep USERNAME and kill the ksh processes that they have?
You may have problems if the process refuses to die, which may happen.
good luck

why dont you download and install "idled" daemon to do this for you in the future.

http://www.darkwing.com/idled/

HTH
Mark

Re: sten's suggestion --> there aren't any associated pid's with a ps stmt...see the above posts.

Re: Mark's suggestion --> I spose this could work, but i would rather reboot the machine and have this fixed that way, than install unneeded software that carries with it, its own security concerns...

thanks though...i think a reboot is all that is left.

zepplin611

Sorry, Zepplin, I was sleeping, I didn't see your post.
The answer is simple.
Type "who -u" instead of "who".
You will see the connected user and the PID of the father shell of each user.
Just kill -9 the PID appearing at the left (just before the system noame) and the user will be kicked out !
Regards
Zorba

Hi zorba4,
Thanks for the post.
It really helped me.

# who
root lft0 Dec 21 06:52
root pts/0 Dec 21 06:52 (:0.0)
root pts/1 Dec 21 06:52 (:0.0)
user1 pts/2 Dec 21 10:23 (172.10.1.115)
user2 pts/3 Dec 21 11:55 (172.10.1.115)
# ps -ef | grep pts/3
user2 708610 847872 0 11:55:29 pts/3 0:00 -ksh
# kill -9 708610