who -R question ?

[boomer_2]

hi guys,
when i do who -R i get the o/p as

root pts/6 Mar 22 13:12 (ge2)
root pts/8 Mar 21 11:03 (ge2)

Does it mean someone has logged in as root from node ge2 to my node ge1..i m giving who -r in ge1...bcoz .rhosts has an entry of root in both nodes....What should i do now??

[Peter Godron]

Hi,
assuming the host where you ran the "who -R" command is ge1.
It means two root sessions have logged in from ge2.
Security is notoriously difficult to monitor if you have .rhosts files.

First check whether it valid that the root account from g2 is logged on. Check permissions on your .rhosts files.
You may want to inspect the sulog and use who on ge2 to find out who is logged on as root.

Please also read:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

[boomer_2]

hi Peter,
on ge2 if i give who -R then there is no entry as root login....whereas my sulog of node ge1 shows someone logged as root-root....

[Peter Godron · Accepted solution]

Hi,
check the sulog on ge2, as the situation could be:
userA logs onto ge2, then "su"s to root
This user then uses the .rhosts file to get to ge1, where it would show up as root-root.
Also, do the times of connecttion give you any clues ?