Politely telling a user to log off ...

[A. Daniel King_1]

I need to log off users after a specified period of time. Calculating the time is not the problem, but the method of pushing folks off -is- a point of discussion.

Is there a way to do this politely? Or more politely than killing telnetd per session? More politely than killing shells?

I suspect that you security folks will be better equiped to answer this than the general admin forum ... Thanks!

[Rodney Hills · Accepted solution]

I give a 5 minute warning first. Then anyone who has not logged off I do a kill -15 on their process (this allows the application to do cleanup), then I do a kill -4 on those remaining (a little harder kill), then I do a kill -9 (the hardest kill).

-- Rod Hills

[James R. Ferguson]

Hi:

Send them a 'wall' message (see man pages) with the text of your choice. Let them know a couple of times that n-minutes remain and then 'kill -15'.

Regards!

...JRF...

[PIYUSH D. PATEL]

Hi,

Best way is to send wall mesage and if the users dont respond then execute a kill -15

If the users are not on their seat then kill -15 and then kill -9 command.

Piyush

[Helen French]

I would think of these methods:

1) Display some message about the "maximum allowed operating time" while the user logs in ( in the profile file ? echo ?), if the time has been pre-determined for that user.
2) Display the message to the user/users using write(1) or wall(1m)
3) Find out the processes running by the user
4) Kill those starting from the *child* processes (kill -15)
5) Kill the session at the last

my 2 cents ..

[Paula J Frazer-Campbell]

Hi

Give them a a warning on login and also via their .profile echo back to them time remaining with a 15, 10 and 5 min countdown.

If you can give them an extension option, i.e. if they enter a specific command then that is logged and it would allow a further 30 min.

Fun to script but not impossible.



Just an idea

Paula

[A. Daniel King_1]

Good answers. The rest is details ...

1) I don't see kill -4 in the kill man page. What signal is this?

2) kill -15 appears to be the default kill level.

3) Is there a quick script or kill option which will do the 'child first' killing? I am reminded of pstree. What happens if the telnetd session is killed with -15? Do the children not get time to clean up?

Thanks again!

[Wodisch]

Hi Daniel,

there was a tool named "idled" in the past which checked for inactive users and logged them off - automatically...

Something for you?

HTH,
Wodisch

[A. Clay Stephenson]

To answer one of your questions - Kill -4 is illegal instruction. Kill -l will lisat the signals to stdout.

By the way, I would NEVER routinely kill with kill -9 as part of a routine watchdog daemon. With kill -9, you might very well find that the cure is worse than the disease of idle processes. You stand a very great risk of leaving shared memory segments, message queues, and temp files in place using kill -9.

My preference would be to send the signals in this order: 15,1,2,3,11. Use kill -0 PID after a brief sleep to see if the process is still active before sending the next signal. I think that you will find that kill -11 is almost as sure a kill as kill -9 but does cleanup.

[Nick Wickens]

We do this to all our users every evening to ensure they are off the database at the point the backup start - I find that 5 minute wall messages over a 15 minute period works best prior to going in for the kill. Most users still in the building do comply by that time unless they have gone home leaving their terminals open for the cleaners to hack :).

The script I use however also ensures that no one can login from the first wall message until the reason for them being off the system has gone. You would probably not be surprised at the number of users that will log straight back in after being killed (The living dead !). I also do a selective kill - You may not want/need to kill any other root type logins to do what you want to do.

[Tania Ap. Serpa Martins]

When I need to get my users off of the system, first I put the message in /etc/profile and finish off the session.
After that, I asked all users to log off in 5 minutes and after this period I checked the users that is still logged on with "who -u" and use the commands that the others collaboraters said: "kill -15" and "kill -9" if the session is not finished.


T??nia

[Bill McNAMARA_1]

If you want to be _real_ polite you should telephone them..

Use the command whodo to find out who's logged in, how long, and what they're doing at the time.

Later,
Bill

[A. Daniel King_1]

kill -11 is a wonderful thing ... even with the core files. Thanks for the replies.

[H.Merijn Brand (procura]

Read this thread http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x026250011d20d6118ff40090279cd0f9,00.html to find great ways other than whodo to find out who is still on and what they are doing

[A. Daniel King_1]

I've been reading the 'favorite scripts' thread for a couple of days now, and I've adopted some of the ksh items to perl. I may post the results, if they prove useful. I've got some ideas of my own, too ...

[Martin Johnson]

Before killing off users, you should disable logins to prevent new and existing users from logging on.

There are several ways to disable logins. The following in /etc/profile will stop most users:

echo "Logins are disabled - please try again later"
exit



Marty

[A. Daniel King_1]

In this case, I'm trying to kill *one* user.

Er, account ... nothing personal.

I'll consider the implications.

[Ameet_HP]

I use wall message & allow users to complete their job for next 5 minutes. Of course, if downtime is already scheduled, then users need to log out immdtly. I also use a script which is invoked from /etc/profile. That script will stop new users to log in & will get some message. I allow only Administrators to login in that script. Next either stop databse & rest applications which we should not kill. To kill users, I check their PIDs in who -u command & kill those using -15 & 9 if required. That does not affect any application. Shutdown the System.

Ameet