last command shows all logons as still logged on

[John Henrikson]

Hello,
I've got A.03.61.002 HP-UX Secure Shell installed on my box, and telnet disabled. When I run the 'last" command it shows everyone who has logged on as 'still logged in'..
Can anyone tell me how to fix this?

Many thanks
John Henrikson

[Steven E. Protter]

last command shows ssh/secure shell logons.

Are you sure all ssh users are out?

It could also be a corrupt /var/adm/wtmp database.

> /var/adm/wtmp

That will clear it.

Some security auditors frown on deleting this file without getting a copy.

SEP

[Naveej.K.A]

Hi John,

Does who -u show the same output?

Are you able to kill the users, whom you feel have logged out?
fuser -ku ttyname will terminate the user session.

This is mainly cause becaused of the corrupted /var/adm/wtmp file.

Regards,
Naveej

[John Henrikson]

No a 'w' or who -u shows only currently logged on users. I'll try clearing the wtmp file.. thanks.
John H.

[Sanjay_6]

Hi john,

Looks like a problem with ssh. The fix was done in version 3.7

Take a look at the thread below from itrc,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000073672029

The itrc doc id is 8606339791.

To download the latest version(A.03.81) of ssh, try software.hp.com

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

Hope this helps.

Regds

[John Henrikson]

As I think about it I doubt this is the case, as wtmp started over again on 1-Dec.
I cleared it out, but really doubt it will solve the problem.
I think it must be ssh related.
JH

[D Block 2]

who -a /etc/wtmp | tail

look at the exit values.

[John Henrikson]

exit=0

still last, shows all users as still logged in..

thanks. JH

[John Henrikson]

No I have to amend that.. in some cases it doesn't have an exit value, just the name of the terminal it connected from. sorry.