I was wondering how i can see all the users logged in to a computer (via ssh) and terminate their session, if needed.

So basically what i am asking is:
-how do i see all logged in users (via ssh)
-how do i terminate somebody else's session remotely (over ssh, as root)

Thanks!

1) w

2) kill <pid>

I'd use

killall -u <user>

I haven't had a chance to "kick" anybody yet, but wouldn't kill or killall just terminate the user's processes, not log them out?

killall definitely does the trick, just su to a user (su <user>, hopefully not patronising you there) then open a root shell and try killall, and voila

How do you think does the user stay "logged in" if you
rip the shell he's using away from under his bottom? :}


Cheers,
Tink

Great way of putting it, Tinkster. Now i get it: no shell, no "being logged in". To get back the shell, the user has to enter his password again. Problem solved!!

I never knew that there was a command "W". Thanks for the great help!

Thanks everybody!

Another good way to logout a user logged in via ssh is to
issue the following command, especially if you don't wanna kill all the processes owned by that user

ps -ef|grep sshd

this will list the sshd processes running for each user logged in, killing the sshd for a particular user will obviously log him out.

Isn't this exactly what killall -u will do?

No; it would kill all his processes. E.g. if he had fired up some
CPU intense app as night-processing in a screen session you'd
kill that along with the login-shells.

But that said:
killall -V
What do you get?

Because my killall doesn't know a -u option, I'd be using
skill -u user -c command


Cheers,
Tink

killall has no option to kill processes by the user name instead you have to give the process name.

killall does have an option to kill by username, killall -u foo, kills all of user foos processes logging them out in effect. I have now noticed the difference of doing "ps -ef|grep sshd", I'm sorry for the misunderstanding it appears I didn't even read the command as I believed it did something entirely different so now I'ver made a fool of myself :P I'll blame the late hour.

P.S the version info for killall as requested, what version are you using then?

killall (PSmisc) 21.9
Copyright (C) 1993-2005 Werner Almesberger and Craig Small

An older one :}

Mine comes with procps-3.2.3, its version number is 21.4.

[edit]
I'm seriously confused now ...
I downloaded and installed the latest procps from
http://procps.sourceforge.net/download.html
(3.2.6) and my killall still doesn't have a
-u option ... what distro are you running? They're
obviously patching stuff into that program that the
original author didn't intend to be there. In fact,
a killall -V of the latest still gives a 21.4.
[/edit]


Cheers,
Tink

I'm running an unstable gentoo, and the version of prcps installed is 3.2.6. Looking at the installation output there are no patches applies whose name would suggest adding this functionality, only ones for solving build issues on different architectures adn some unrelated features. And the source package is the same as the version downloaded off procps homepage (compaing md5sums), perhaps configure flag settings? though I don't see why this would cause the version change. This is a bit weird.

if your interested these are the patches applied:

emerge procps
* Applying 3.2.5-top-sort.patch ... [ ok ]
* Applying procps-3.2.5-proc-mount.patch ... [ ok ]
* Applying procps-mips-define-pagesize.patch ... [ ok ]
* Applying procps-3.2.6-mips-n32_isnt_usable_on_mips64_yet.patch ... [ ok ]