Multiple "users" on my single user computer Linux Mint 18.x

StevenSmithCIS · 09-30-2017, 10:59 AM

So, I'm logged in as usual, doing my stuff, but there seems to be 3 people logged in and I'm the only one using this computer at home.. ??

This is my 'w' output..

Code:

 08:55:16 up 37 min,  3 users,  load average: 2.38, 1.79, 1.31
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
oem      pts/0    :0               08:18   36:17   0.00s  1.57s kded5 [kdein
oem      pts/1    :0               08:19   19:22  14:52   0.18s /bin/bash
oem      pts/2    :0               08:41    0.00s  0.16s  0.06s /bin/bash

MensaWater · 09-30-2017, 12:03 PM

pts = Pseudo Terminal the numbers indicate you are running 3 separate pseudo terminals. The first one on gets pts/0, the next pts/1 etc...

This can happen if you open multiple sessions (e.g. PuTTY from MS Windows) or ssh in from other systems into this system It is also common if you're running a GUI Windows Manager such as Gnome or KDE and have opened "terminal" command line windows within your desktop.

If you notice it doesn't show 3 separate users. It shows the user, oem, with 3 separate sessions.

However, you COULD have different "users" on different sessions depending on what you are doing.

Finally it does occur that on occasion if you neglect to "exit" a session properly but simply close it then it will still appear to be running.

StevenSmithCIS · 09-30-2017, 02:33 PM

Quote:

Originally Posted by MensaWater

pts = Pseudo Terminal the numbers indicate you are running 3 separate pseudo terminals. The first one on gets pts/0, the next pts/1 etc...

This can happen if you open multiple sessions (e.g. PuTTY from MS Windows) or ssh in from other systems into this system It is also common if you're running a GUI Windows Manager such as Gnome or KDE and have opened "terminal" command line windows within your desktop.

If you notice it doesn't show 3 separate users. It shows the user, oem, with 3 separate sessions.

However, you COULD have different "users" on different sessions depending on what you are doing.

Finally it does occur that on occasion if you neglect to "exit" a session properly but simply close it then it will still appear to be running.

Ok. It was just weird because my internet connection wasn't working or was EXTREMELY slow, but that could be because of the VPN too. Sometimes the connection dies and I have to connect to a different server. Interesting. Ok. Yeah, I sometimes run a few terminal windows and do stuff in each one. Not real surprised, but I am paranoid (only the paranoid survive!).

Perhaps I could turn it into a multi-part question (in case anyone has these same questions) and ask what might be the way of determining if my machine was a bot, or someone was running a meterpreter or some other hacking software session connected to a legit host thread (such as the KDBE5). ??

rhubarbdog · 11-16-2017, 01:36 AM

Quote:

Originally Posted by StevenSmithCIS

I am paranoid (only the paranoid survive!).

So am I. i put opaque tape over my laptops camera to avoid being on hacked cctv.

I also would like to block the micro phone to avoid being hack bugged . It may be as easy as plugging a 3.5 mm jack into the external microphone socket,(you know like how head phone disconnect the speaker)