Re: [cobalt-users] RaQ3i: Admins witch are "still logged in"

[flash22@xxxxxxx]

On Thu, 5 Apr 2001, Urs Weiss - Asenis wrote:

> After i had some broken connections (most with ssh) i found some admin users
> witch are "still logged in" ==> see below.
> 
> [root@www admin]# ps --version
> procps version 1.01

You should have a MUCH newer ps than this, you have most likely been
hacked....

'top' may work where ps doesn't , unless it's been fooled with too, you an
look at the raw data tha ps would have given you by looking in /proc

> Somone knows what kind of problem it could be? Or an other way to kill the
> "still logged in"-users.

fuser will give you pid from pty

for all the tty's
for i in  /dev/ttyp*;do /usr/sbin/fuser $i;done
for all the pty's
for i in  /dev/pty*;do /usr/sbin/fuser $i;done

gsh