Identify all users logged in to the system even with su command

mathewhai · 07-09-2014, 10:31 PM

My requirement is to know all users who are active in the system.

But generally I login to my machine as root and then do "su" to my user.

"who" command will return all users logged in to the system, but not the user who is logged in with su command.

Please help me here, the best way to identify all users logged in to the system, who is even logged in with an su command.

Thanks in advance.

netnix99 · 07-10-2014, 07:39 AM

'who' registers the logged in user; therefore, it will list your login as root. The 'su' command simply gives you the ability to pose as another user;therefore, you are not actually logged in to the computer as that user, and you will not show up in the 'who' or 'last' (wtemp) as that user.

Best Business Practices will stipulate that you are logging in incorrectly. You "SHOULD" log in as a regular user and 'su to root' only when needed. This helps mitigate incidents where unrecoverable (or at least PAINFUL) modifications are made by unintentionaly using root to access to the system or files.

I'm not trying to tell you what to do, just stating the BBP's for security....

HTH

mathewhai · 07-11-2014, 08:33 AM

To make it simple, I login with my username and su to a systemmaint user by entering password. How to find this active user?

schneidz · 07-11-2014, 09:19 AM

this user is logged in remotely as root via su -

Code:

[schneidz@hyper ~]$ w
 10:18:11 up 23:21,  6 users,  load average: 0.89, 0.97, 0.88
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
schneidz tty4                      10:14    2:31   0.20s  0.28s login -- schneidz     
schneidz tty1     :0               Thu10   23:20m 15:46   0.42s pam: gdm-password
schneidz pts/0    :0.0             Thu11    4:36   0.06s  0.06s bash
schneidz pts/1    :0.0             Thu11    5.00s  1.03s  0.13s ssh xbmc
schneidz pts/2    :0.0             Thu11    0.00s  0.23s  0.07s w
schneidz pts/3    xbmc             10:16    5.00s  0.20s  0.44s sshd: schneidz [priv]