Phantom guest logins

Date: Tue, 18 May 1999 11:43:37 -0300 (ADT)
From: "David L. Potter" <potter@chebucto.ns.ca>
To: David Lott <david@pgfn.bc.ca>
cc: CSuite Technical Team <csuite-tech@chebucto.ns.ca>, Report System Problems <support@pgfn.bc.ca>, Linux Mailing List <linux@vaughan.fac.unbc.ca>
Precedence: bulk
Return-Path: <csuite-tech-mml-owner@chebucto.ns.ca>

next message in archive
next message in thread
previous message in archive
previous message in thread
Index of Subjects

Index of Subjects

Hi David... 

My guess is that they're orphaned/defunct processes that have died for
some reason... 

I'd check the number of guest sessions `w` against the output of 
`last | grep guest` and perhaps 'ps aux | grep $CS_ROOT' which may turn up
processes that have been inherited by init (PID 1).

Is there a pattern... 
 - time of day the sessions start
 - remote host...?

You should be able to find the session in the output of `last` which
should show the original tty.

If the sessions is truly orphaned I think you can just leave it unless
it's making a nuisance of itself in some way.

david potter



On Tue, 18 May 1999, David Lott wrote:

> 
> Lately we have been getting a lot of "phantom" logins by guest.
> They are reported by 'who' and 'finger' but not by 'w'. 
> 
> An example 'who' listing:  
> "guest tty??  May 16 17:58 (elrond.pgfn.bc.ca)".
> 
> Note the 'tty??'.  
> 
> At the moment there are 24 of these listed by 'who'.  There is no process
> number associated with them so I can't kill the process.  The only way
> I've been able to get rid of them is by re-booting. 
> 
> We are running Linux RH 5.0.   Kernel 2.0.32
> 
> Can someone tell me HOW this happens?
>   
> Should I be looking in Linux or CSuite?
> 
> Cheers, David.
> 
> David M. Lott
> System Administrator
> P.G. Free-Net
> www.pgfn.bc.ca
> Prince George, BC, Canada.
> 

next message in archive
next message in thread
previous message in archive
previous message in thread
Index of Subjects