old shells

[Kevin Wright]

I have a couple dba's who use the system and do not log out correctly, they prefer to click on the X as opposed to typing exit. if I do a 'w' or who -u, one person has 22 shells open, with all but 3 of them saying old in the who -u output, the idle time in some cases is over 300 hours. Other than being really annoying to me, and taking up system resources, is this a security risk, and if so how.
Any suggestions would be greatly appreciated.

[Volker Borowski]

Hello Kevin,

the fact, that your DBAs do this let me assume, that they might execute some database query, that does not return, due to bad responsetime.

If you have a 10GB table in i.e. a SAP database, where someone issues a
SELECT COUNT(*) FROM BIGTABLE;
(which can be a really bad idea)
this might take some time to return.
So this might be the reason why they do not type "exit" -> not possible.

This is bad, because, if the database is i.e. ORACLE, the bad statement is on the database already, and the usersession is in IO-WAIT from OS-view -> This is why the session does not die.

Suggestion:
Check if you only have shells, or if you have query-tool processes as well (svrmgrl, sqlplus[ORACLE] or dbaccess[INFORMIX]). If yes
-> check with your DBAs, that they keep track on killing their sessions if they terminate them this way.
SQL: KILL SESSION ...

This is in their own interest, because the still running statements in their query-tools might eat database-resources (locks, rollback-space, db-buffers), in addition to the CPU.

With killing the SQL-Session, the query tool should die and with this the hanging shell as well.

Hope this helps.
Volker

[Mark Vollmers]

You could go and find the old shells using the "ps -ef" command and kill them. This would get rid of them, but you would have to go through the entire list. YOu might be able to set up a cron to kill all the shell processes daily, but I'm not sure.

Mark

[Kevin Wright]

ya, I know I can kill the processes, but what I am looking for is whether or not this is a security risk to the system, and whether or not this is common in other environments.
They are using an Oracle DB, however, the shells are not getting 'hung' due to slow response time, they just are not logging out correctly.

[Maureen Gunkel]

Kevin,
It's not a security risk per se, but I've got a question for you. What product are they using to connect to the system? If might be a risk if someone gets to their machine and reconnects to the same session. I think that would be highly unlikely, tho'.
Just my 2 cents
Mo

[Kevin Wright]

They are using Hummingbird and Reflections to connect to the system..also, some of these open shells originated from their home, through a RAS.

[Stefan Schulz]

I'm no hacker so i don't really know. But i would think that there is a slight posibillity to reconnct to those shells.

Especially as there are some RAS connections i would definately kill those old shells just to make sure.

Just my thoughts. Stefan