Operating System - HP-UX
1833873 Members
4205 Online
110063 Solutions
New Discussion

last command shows all logons as still logged on

 
John Henrikson
Regular Advisor

last command shows all logons as still logged on

Hello,
I've got A.03.61.002 HP-UX Secure Shell installed on my box, and telnet disabled. When I run the 'last" command it shows everyone who has logged on as 'still logged in'..
Can anyone tell me how to fix this?

Many thanks
John Henrikson
8 REPLIES 8
Steven E. Protter
Exalted Contributor

Re: last command shows all logons as still logged on

last command shows ssh/secure shell logons.

Are you sure all ssh users are out?

It could also be a corrupt /var/adm/wtmp database.

> /var/adm/wtmp

That will clear it.

Some security auditors frown on deleting this file without getting a copy.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Naveej.K.A
Honored Contributor

Re: last command shows all logons as still logged on

Hi John,

Does who -u show the same output?

Are you able to kill the users, whom you feel have logged out?
fuser -ku ttyname will terminate the user session.

This is mainly cause becaused of the corrupted /var/adm/wtmp file.

Regards,
Naveej
practice makes a man perfect!!!
John Henrikson
Regular Advisor

Re: last command shows all logons as still logged on

No a 'w' or who -u shows only currently logged on users. I'll try clearing the wtmp file.. thanks.
John H.
Sanjay_6
Honored Contributor

Re: last command shows all logons as still logged on

Hi john,

Looks like a problem with ssh. The fix was done in version 3.7

Take a look at the thread below from itrc,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000073672029

The itrc doc id is 8606339791.

To download the latest version(A.03.81) of ssh, try software.hp.com

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

Hope this helps.

Regds
John Henrikson
Regular Advisor

Re: last command shows all logons as still logged on

As I think about it I doubt this is the case, as wtmp started over again on 1-Dec.
I cleared it out, but really doubt it will solve the problem.
I think it must be ssh related.
JH
D Block 2
Respected Contributor

Re: last command shows all logons as still logged on



who -a /etc/wtmp | tail

look at the exit values.

Golf is a Good Walk Spoiled, Mark Twain.
John Henrikson
Regular Advisor

Re: last command shows all logons as still logged on

exit=0

still last, shows all users as still logged in..

thanks. JH
John Henrikson
Regular Advisor

Re: last command shows all logons as still logged on

No I have to amend that.. in some cases it doesn't have an exit value, just the name of the terminal it connected from. sorry.