no users are showing as logged out with SSH

[Brian Miller_9]

I've just installed an HP 11.11 system, and installed SSH on it. When I run last, I see every user who has logged in, as still being logged in, even though w/who only shows one user being logged in (with the exception of root, which does seem to properly show a logout). When we use telnet, the user properly shows as being logged out.

The output of last looks like this:

user1 pts/ta Tue Oct 18 11:58 - 11:58(00:00)
root pts/3 Tue Oct 18 11:07 - 11:14(00:06)
user1 pts/2 Tue Oct 18 11:01 still logged in
root pts/2 Tue Oct 18 11:01 - 11:01(00:00)
user1 pts/2 Fri Oct 14 15:17 still logged in
user1 pts/1 Fri Oct 14 12:00 still logged in
user1 pts/1 Fri Oct 14 11:52 still logged in

So what do I need to do in order for the logout times to show up with last?

[D Block 2]

Brian, have you looked at syslog.log file ? You might check doc on ssh_conf file for allowing or disallowing users coming in via ssh. Also, I recall some PAM settings that turn on verbose login/logout events written to syslog.

[Rick Garland]

Are these users coming in from WIN systems? Using CYGWIN or PUTTY?

If so, are they exiting the term window by using the X in the top right corner? Or are they actually doing the 'exit' to logout of the term window?

[HGN]

Hi

I think you need to let the users(windows user) to do an exit and x the window instead of just closing the window.

We had this issue and we set a timeout value and if the session is idle for sometime then the session terminates.

Rgds

HGN

[Brian Miller_9]

It doesn't really matter whether the users are coming from Windows or Linux. Any ssh connection (except for root) will continue to show the user logged when we run "last". And the users are using "exit" to end their session. (I can confirm this, because it happens to my user ID also.)

I increased the log level for sshd to debug, and syslog is properly showing when users login, and SSHD will even record when the user logs out:

Oct 18 15:27:59 tlhxov1 sshd[6482]: Connection from 10.207.96.194 port 1421
Oct 18 15:27:59 tlhxov1 sshd[6482]: Failed none for user1 from 10.207.96.194 port 1421 ssh2
Oct 18 15:28:04 tlhxov1 sshd[6482]: Accepted password for user1 from 10.207.96.194 port 1421 ssh2
Oct 18 15:28:28 tlhxov1 sshd[6485]: Connection closed by 10.207.96.194

We're using LDAP for user authentication, rather than local accounts. Root is a local account, and root is properly being shown as logging out. However, when I create a local user, and use SSH to connect, that account also does not show as logging out with last.

It's as if only root as the necessary permissions to record a logout.

[Ermin Borovac]

What version of ssh are you using? Did you get it from www.software.hp.com?

[Joseph Loo · Accepted solution]

hi,

as ermin has suggested, the version of your SSH is important.

if u r using Secure Shell 3.61.002 or 3.71.001, there are some problem with the logging as well as others.

refer to this for the latest Secure Shell version:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

regards.

[Arunvijai_4]

What is your SSH version ? I remember there was a bug similar to this reported on OpenSSH 3.1 or later.. Try installing latest version OpenSSH 4.1p1 from https://h20293.www2.hp.com/portal/swdepot/try.do?productNumber=T1471AA

-Arun

[Brian Miller_9]

Thanks. It was the version of SSHD that was causing the problem. I updated, and now the logging works fine. Of course, then I had to mess with the sshd_config file to allow LDAP users to login (it seems the newer version needs different options, but that was easy enough to fix).

This is my first HP-UX system. This forum works a lot better than the SUN forums I work with. Again, thanks a lot!!!

[Brian Miller_9]

I needed to update the version of SSHD.

[Arunvijai_4]

http://forums1.itrc.hp.com/service/forums/helptips.do?#28

Also, you can assign more points ;-)

-Arun