[NTLUG:Discuss] ssh login

[TJ Davis]

I appreciate the suggestion but root still shows to be logged in as well as
the test one that I did with the tjdavis account.

T.J. Davis
Southwestern A/G University
Information Technology
tjdavis at sagu.edu
(972) 937-4010 ext. 1255
1 Timothy 4:12



-----Original Message-----
From: Kelledin [mailto:kelledin+NTLUG at skarpsey.dyndns.org]
Sent: Thursday, August 01, 2002 6:09 PM
To: discuss at ntlug.org
Subject: Re: [NTLUG:Discuss] ssh login


On Thursday 01 August 2002 04:22 pm, TJ Davis wrote:
> I am logged into ssh and everything is going good but I have
> just setup this server and remember to go into sshd_config and
> change PermitRootLogin to "no."  After doing that I decided to
> then restart the sshd daemon.  This goes fine but, when I
> logout the server has hung saying that root is logged in to
> ssh.  Even if I have the ssh daemon stopped it shows root to
> be logged in still when I type "who" at the command prompt. 
> To test this I logged into ssh remotely as "tjdavis" and
> killed the daemon while logged in.  I went into the server
> room and typed "who" and sure enough it shows tjdavis to still
> be logged in.  Anyone know how to fix this.  I hope I made
> sense. If you need clarification let me know.

Not completely sure about this, but IIRC "who" determines who's 
logged in by examining the system utmp file (usually /etc/utmp 
or /var/run/utmp).  It's the responsibility of login programs to 
record login/logout events in this file.  If you kill root's ssh 
session abruptly with kill -9, then chances are, root's logout 
didn't get noted in the utmp file.

First of all, stop the SSH service and type `pidof sshd` to make 
there are no running sshd processes.  Then login as root, 
logout, and see if the problem goes away.

-- 
Kelledin
"If a server crashes in a server farm and no one pings it, does 
it still cost four figures to fix?"

_______________________________________________
http://www.ntlug.org/mailman/listinfo/discuss
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://ntlug.org/pipermail/discuss/attachments/20020801/f3cda6cb/attachment.html