topic last command shows all logons as still logged on in Operating System - HP-UX

last command shows all logons as still logged on

John Henrikson — Thu, 02 Dec 2004 15:33:16 GMT

Hello,
I've got A.03.61.002 HP-UX Secure Shell installed on my box, and telnet disabled. When I run the 'last" command it shows everyone who has logged on as 'still logged in'..
Can anyone tell me how to fix this?

Many thanks
John Henrikson

Re: last command shows all logons as still logged on

Steven E. Protter — Thu, 02 Dec 2004 15:35:15 GMT

last command shows ssh/secure shell logons.

Are you sure all ssh users are out?

It could also be a corrupt /var/adm/wtmp database.

> /var/adm/wtmp

That will clear it.

Some security auditors frown on deleting this file without getting a copy.

SEP

Re: last command shows all logons as still logged on

Naveej.K.A — Thu, 02 Dec 2004 15:36:18 GMT

Hi John,

Does who -u show the same output?

Are you able to kill the users, whom you feel have logged out?
fuser -ku ttyname will terminate the user session.

This is mainly cause becaused of the corrupted /var/adm/wtmp file.

Regards,
Naveej

Re: last command shows all logons as still logged on

John Henrikson — Thu, 02 Dec 2004 15:40:56 GMT

No a 'w' or who -u shows only currently logged on users. I'll try clearing the wtmp file.. thanks.
John H.

Re: last command shows all logons as still logged on

Sanjay_6 — Thu, 02 Dec 2004 15:44:43 GMT

Hi john,

Looks like a problem with ssh. The fix was done in version 3.7

Take a look at the thread below from itrc,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000073672029

The itrc doc id is 8606339791.

To download the latest version(A.03.81) of ssh, try software.hp.com

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

Hope this helps.

Regds

Re: last command shows all logons as still logged on

John Henrikson — Thu, 02 Dec 2004 15:45:05 GMT

As I think about it I doubt this is the case, as wtmp started over again on 1-Dec.
I cleared it out, but really doubt it will solve the problem.
I think it must be ssh related.
JH

Re: last command shows all logons as still logged on

D Block 2 — Thu, 02 Dec 2004 15:52:17 GMT

who -a /etc/wtmp | tail

look at the exit values.

Re: last command shows all logons as still logged on

John Henrikson — Thu, 02 Dec 2004 16:33:11 GMT

exit=0

still last, shows all users as still logged in..

thanks. JH

Re: last command shows all logons as still logged on

John Henrikson — Thu, 02 Dec 2004 16:34:33 GMT

No I have to amend that.. in some cases it doesn't have an exit value, just the name of the terminal it connected from. sorry.