<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: [NTLUG:Discuss] ssh login</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Now that I have been told that there is basically nothing that I can do except for reboot, unless I understood wrong, I am satisfied. That is all that I needed to know. Unfortunately rebooting is not an option. Just to clarify, the reason that I was concerned about it is because I use the "who" and "w" command frequently just to check and see who is logged in for security purposes but now I know that I cannot depend on that and I will no longer continue to do so. Thanks to everyone who provided info to help me with this matter.</FONT></P>
<P><FONT SIZE=2>T.J. Davis</FONT>
<BR><FONT SIZE=2>Southwestern A/G University</FONT>
<BR><FONT SIZE=2>Information Technology</FONT>
<BR><FONT SIZE=2>tjdavis@sagu.edu</FONT>
<BR><FONT SIZE=2>(972) 937-4010 ext. 1255</FONT>
<BR><FONT SIZE=2>1 Timothy 4:12</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Steve Baker [<A HREF="mailto:sjbaker1@airmail.net">mailto:sjbaker1@airmail.net</A>]</FONT>
<BR><FONT SIZE=2>Sent: Wednesday, August 07, 2002 8:36 AM</FONT>
<BR><FONT SIZE=2>To: discuss@ntlug.org</FONT>
<BR><FONT SIZE=2>Subject: Re: [NTLUG:Discuss] ssh login</FONT>
</P>
<BR>
<P><FONT SIZE=2>TJ Davis wrote:</FONT>
<BR><FONT SIZE=2>> so do you have a solution as to how to fix the problem? The first and </FONT>
<BR><FONT SIZE=2>> only suggestion did not work.</FONT>
</P>
<P><FONT SIZE=2>Well, firstly, to be absolutely clear about this: The user *ISN'T* still</FONT>
<BR><FONT SIZE=2>logged in after the machine was rebooted - that's simply not possible.</FONT>
<BR><FONT SIZE=2>It's only that the utmp/wtmp files didn't get updated to show that they</FONT>
<BR><FONT SIZE=2>logged out - so if you *ask* whether they are logged in or not using 'who'</FONT>
<BR><FONT SIZE=2>or something like it, you get the wrong answer.</FONT>
</P>
<P><FONT SIZE=2>So this shouldn't be a terrible security problem or a drain on system</FONT>
<BR><FONT SIZE=2>resources or anything like that.</FONT>
</P>
<P><FONT SIZE=2>So - what can you do?</FONT>
</P>
<P><FONT SIZE=2>Unless this is causing you some kind of terrible grief - I'd do *nothing*</FONT>
<BR><FONT SIZE=2>UNIX has been working like this since the early 1970's and everyone is used</FONT>
<BR><FONT SIZE=2>to flakey results coming back out of utmp/wtmp.</FONT>
</P>
<P><FONT SIZE=2>But if you absolutely have to fix it, I'd wipe out the utmp/wtmp files on</FONT>
<BR><FONT SIZE=2>reboot. That'll ensure that they are not going to show any bogus</FONT>
<BR><FONT SIZE=2>information from before the reboot - and the only loss will be that users</FONT>
<BR><FONT SIZE=2>won't be told when they last logged in or logged out if the machine had</FONT>
<BR><FONT SIZE=2>to be rebooted in the meantime.</FONT>
</P>
<P><FONT SIZE=2>Heck - this is Linux - machines frequently go for YEARS between reboots!</FONT>
</P>
<P><FONT SIZE=2>----------------------------- Steve Baker -------------------------------</FONT>
<BR><FONT SIZE=2>Mail : <sjbaker1@airmail.net> WorkMail: <sjbaker@link.com></FONT>
<BR><FONT SIZE=2>URLs : <A HREF="http://www.sjbaker.org" TARGET="_blank">http://www.sjbaker.org</A></FONT>
<BR><FONT SIZE=2> <A HREF="http://plib.sf.net" TARGET="_blank">http://plib.sf.net</A> <A HREF="http://tuxaqfh.sf.net" TARGET="_blank">http://tuxaqfh.sf.net</A> <A HREF="http://tuxkart.sf.net" TARGET="_blank">http://tuxkart.sf.net</A></FONT>
<BR><FONT SIZE=2> <A HREF="http://prettypoly.sf.net" TARGET="_blank">http://prettypoly.sf.net</A> <A HREF="http://freeglut.sf.net" TARGET="_blank">http://freeglut.sf.net</A></FONT>
<BR><FONT SIZE=2> <A HREF="http://toobular.sf.net" TARGET="_blank">http://toobular.sf.net</A> <A HREF="http://lodestone.sf.net" TARGET="_blank">http://lodestone.sf.net</A></FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>_______________________________________________</FONT>
<BR><FONT SIZE=2><A HREF="http://www.ntlug.org/mailman/listinfo/discuss" TARGET="_blank">http://www.ntlug.org/mailman/listinfo/discuss</A></FONT>
</P>
</BODY>
</HTML>