who -u does not show ssh connected users

[Geoff Wild]

Okay, this one is strange.

I have 2 systems, same patch levels, same O/S release, same software installed, one is the dev and other is prod.

# swlist |grep -i oe
HPUX11i-OE-Ent B.11.23.0505 HP-UX Enterprise Operating Environment Component

/etc/profile, /.profile/ sshd_config are identical.

Yet, on one server (prod), who -u does not show the ssh connected users...

Yet, when I strings /etc/utmp I see my name!

Also, who am i does not work either (on prod).

id does.

I have tried zeroing the utmp utmps btmp files...no luck...

Rgds...Geoff

[A. Clay Stephenson]

The differences could be in the /var/adm/wtmp files but in any event, who -u, should really be considered a "best guess" by the system. Over the years and over many flavors of UNIX (including HP-UX), I have learned to never, ever trust who as a definitive answer. Instead the process table (ps) is a far more reliable resource.

[Geoff Wild]

Thanks Clay - yeah, I know about it being unreliable...

Now I have to wait for a reboot to see if it resolves itself.

During the meanwhile (always wanted to say that), how can I do the equivalent of `who am i` in the following?

We maintain a separate .sh_history file for each admin who su's to root.

In root's .profile we have:


# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
# there is something wrong with: print -s $(date) >>$HISTFILE
date >>$HISTFILE
export HISTFILE
HISTSIZE=5000
export HISTSIZE

Rgds...Geoff

[OldSchool]

long shot, but see if their is anything in ~/.ssh/config

[Denver Osborn]

Geoff,

for your histfile question, what about using logname instead?

REAL_NAME=`logname`
HISTFILE=${HOME}/.sh_history_${REAL_NAME}

-denver

[Geoff Wild]

So far, I have come up with this elaborate scheme:

# Set up logging
# who am i breaks
#HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
# find out who we are
PTY=`ps -ef |grep boks_sshd |grep -i grep |awk '{print $6}'`
export PTY
ADMIN=`ps -ef |grep @$PTY |grep -v grep |awk '{print $9}' |awk -F@ '{print $1}'`
export ADMIN
HISTFILE=${HOME}/.sh_history_$ADMIN
export HISTFILE
# there is something wrong with: print -s $(date) >>$HISTFILE
HISTSIZE=5000
export HISTSIZE
date >>$HISTFILE

As you see, we use boks here.

Rgds...Geoff

[Geoff Wild]

Denver - logname is the same as who - seems to think I am someone else:


root@mysvr011 [ / ]
# logname
epic0015

Should be gwild

Rgds...Geoff

[Denver Osborn]

Is UsePrivilegeSeparation set to "Yes" in sshd_config?

-denver

[Geoff Wild]

No - it is set to no

Same as all other servers.

Rgds...Geoff

[Geoff Wild]

Got it down to this:

ADMIN=`ps -ef |grep $PPID |grep -v root |awk '{print $1}'`


Rgds...Geoff

[Bill Hassell · Accepted solution]

> Got it down to this:

> ADMIN=`ps -ef |grep $PPID |grep -v root |awk '{print $1}'`

This is incredibly unreliable. If PPID is 12 then process number 12 123 2212 34125 as well as command lines -t alltext12 and userID bill12 will all match. It is best to avoid ever using grep with ps. The main reason is that grep has a 100% accurate match for selected parameters. A rock solid replacement is:

ADMIN=$(ps -fp $PPID | awk '{print $1}')

Or even better by using the UNIX95 variable, you can drop the awk processing:

ADMIN=$(UNIX95=1 ps -p $PPID -o user=)

man ps has some very powerful exact match options such as -p and -u, and with UNIX95 set, -C gives an exact process name match. And these accurate options allow for multiple items such as -p 12,123,4567,2 -u billh,bill,joe4 -C sfd,sh,dm_stape UNIX95 also activates the -o option to customize the output from ps. And the = can be used to label the columns, with -o user= specifying no label at all. If all columns are set to null, then no column header is displayed.

Note also that `` (grave accents) have been deprecated for many years. Not only are they very difficult to read and mistake for '' but they cannot be nested. $() is the recommended syntax for modern shells.

[Geoff Wild]

I knew the ps |grep wouldn't work the best - due t reason's Bill said.

I'm glad you jumped in Bill - thanks a lot for this:

ADMIN=$(UNIX95=1 ps -p $PPID -o user=)


Rgds...Geoff

[Geoff Wild]

Okay, looks like I spoke too soon...

Bill, very strange result, now when I su to root, I see what appears to be 2 history files for me:

# ll
total 1154
drwx------ 3 root sys 96 Feb 28 2006 .mozilla
-rw-r--r-- 1 root sys 9 Feb 28 2006 .mozilla-license
-r--r--r-- 1 bin bin 1722 Jan 24 07:26 .profile
dr-x------ 3 root sys 96 Mar 27 2006 .secure
-rw------- 1 root sys 43068 Jan 23 12:34 .sh_history_
-rw------- 1 root sys 10058 Aug 15 16:06 .sh_history_admin1
-rw------- 1 root sys 8746 Jan 24 07:29 .sh_history_gwild
-rw------- 1 root sys 50 Jan 24 07:28 .sh_history_gwild


Rgds...Geoff

[Geoff Wild]

ping

[Geoff Wild]

BTW, doing this:

ps -fp $PPID | awk '{print $1}'

displays

UID
gwild

So I added a grep -v UID

Rgds...Geoff

[Peter Nikitka]

Hi Geoff,

I don't know, if you tried
id -un

In your last solution, there is no need for a grep, instead
ps -fp $PPID | grep -v UID | awk '{print $1}'
use
ps -fp $PPID | awk 'NR {print $1}'

Your 'll' outout:
Two identical filenames in one directory?
There must be hidden characters in (at least) one filename!

mfG Peter

[Geoff Wild]

Peter, doesn't seem to work?

# ps -fp $PPID | awk 'NR {print $1}'
UID
gwild


Rgds...Geoff

[Tom Danzig]

Geoff,

As the 'id' command works, perhaps you could change:
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`

to:
HISTFILE=${HOME}/.sh_history_`id -un`

[Geoff Wild]

Tom,

id -un

shows the current user id - ie root - not the person who su'ed to root.

Rgds...Geoff

[Tom Danzig]

Agreed. How about using `logname`

[Geoff Wild]

logname uses same access as who - utmp/btmp files - so on a system that has those corrupted you get:

# logname
logname: could not get login name


Rgds...Geoff

[Peter Nikitka]

Sorry Geoff,

something was dropped:
ps -fp $PPID | awk 'NR>1 {print $1}'

mfG Peter

PS: For me id -un workes even with 'su' (HP-UX 11i; Solaris10).

[tom edginton_1]

Hmm. ADMIN=$(UNIX95=1 ps -p $PPID -o user=) seems to pad $ADMIN with spaces to whatever the column width is.

If you echo "[$ADMIN]" you will probably see something like [gwild ] returned.
This is why you are seeing 2 history files listed - one with trailing spaces, one without.

Try simply:

ADMIN=`UNIX95= ps -p $PPID -o user= |sed 's/ //g'`.

This should get rid of the trailing spaces.

rm .sh_history_gwild* and next time you login you should just keep one correct history file.

[Geoff Wild]

Looks like Tom has solved it!

Rgds...Geoff