Hi,

I created another user for my system to let a friend try connecting to my system by ssh.
It worked but now, I can't seem to remove the user...

Even after rebooting, shutting down, the command "users" shows my friend to be logged in. What gives? How do I get rid of the user?

I'm not an expert at any of this but, you could use the "userdel" command to remove the friends account. I have no idea why it shows that he is still logged in. But anyway, suppose your friends user name is "friend1" or something like that. You could type this:

userdel -r friend1

I believe the "-r" will cause the files in the user's home directory will be removed along with the home directory itself and the user's mail spool. You can look up more about the "userdel" command by typing this:

man userdel

It sounds like you know how to tell if some one is logged in. One way to tell if someone is currently logged in is to type this:

w

To see the last 10 log-ins you could type this:

last -10

Erm... the command "users" shows my friend to be logged in but "w" shows only roots and myself...
I can't use userdel because i'm prompted with error stating that the user is still logged in.

try (as root) in a terminal

userdel <username>

where <username> is the login-username of the user you want to remove. if you have created a home directory, for example, too and want to remove it and all the files in it also when you remove the user, use

userdel -r <username>

instead. the -r switch means "remove user files too"...for more details, check

man userdel

if you don't get rid of the login, try starting your machine in a single-user mode (runlevel 1); for example, in a terminal try

init 1

or then change your /etc/inittab settings to boot into runlevel 1..(default runlevel). this should prevent other logins...

Another way to approach this problem is to use the "kill" command. If you can not log him out you may need to find his process ID number and use the "kill" command to kill the process. To find his process ID number you can use the "top" command and look for a proccess ID next to his name. You could type this:

top

Suppose that you find that his process ID number is 1792 or something like that (it will actually be a different number on your system). Then type this:

kill 1792

You might also want to look those commands up using the "man" command.

Nope, still no luck...
Running init 1 shows him still logged in. No processes listed under "top".

On my computer there are always dozens of processes listed under "top". There are always some processes running. Some of the processes are controlled by me and some by root. If the top command did not work you could look at all processes with this command instead:

ps -A

I may have possibly been wrong when I suggested that you could use the "kill" command to log him out. B0uncer's suggestion to change the runlevel might be better. Perhaps using the "init" command did not work properly for some reason. You might need to manually edit the inittab file to change the run level. The inittab file is located in the /etc directory. I am not sure which distro you are using or which text editor you use. But, suppose you use "gedit", when you are logged in as root you could type this to edit the file:

gedit /etc/inittab

Once the file is open you should see two lines that looks something like this:

# Default runlevel. (Do not set to 0 or 6)
id:3:initdefault:

The line with the "#" sign in front is just a comment. On the next line you need to change the 3 to a 1. You can then save the change and reboot. You should then be in single user mode. That sould do the same thing as what the "init 1" command should have done.

Was ssh already running by default when you installed Linux? Do you actually have any reason to have that running? For now at least you might want to shut down the sshd daemon that ssh uses. With most versions of Linux (but not Slackware) you could temporarily shut the sshd daemon down with this command:

/etc/rc.d/init.d/sshd stop

That will only temporarily stop the sshd daemon and prevent using ssh and sftp for now. It will not keep it from automatically starting up when you reboot.

You might also want to see what processes (if any) that the user is using. Suppose his username is "jimbo", then you could use this command to see what processes jimbo is using:

ps -u jimbo

If you can not delete his account for some reason then you should probably at least use the "passwd" command to change his password. If his name was jimbo you could type this:

passwd jimbo