I (logged in as "user1", has root access) was following this to experiment with kicking a client ssh session logged in as "user2" (has no root access), connected from the same network from a laptop. The results of the who -u
command showed both "user1" and "user2"
15:15:59 up 2:03, 2 users, load average: 0.00, 0.03, 0.09
user1 :0 2020-03-28 13:59 ? 4232 (:0)
user2 pts/1 2020-03-28 14:40 . 13155 (192.168.1.15)
I then did
sudo kill -9 13155
to assumingly kill their ssh session.
But not only did it not work (the terminal connected using ssh from my laptop as user 2 still has an active SSH session and is able to run commands), the new results of who
don't show that running ssh session anymore!!!!
user1 :0 2020-03-28 13:59 ? 4232 (:0)
Am I misunderstanding how who
and kill
commands work? who
should list all logged in/active users. But clearly it doesn't as user2 is logged in but not listed by who
.
I am willing to run any (well.. not literally ANY ;) ) commands and share the output with you to help me figure this out.
who
command just displays the content of the/var/run/utmp
file. No more no less. See my comments here, here and here. Check if that ssh process is still running withpgrep -a <pid>
orps <pid>
. – Mar 29 '20 at 00:06ps <pid>
, sorry – Mar 29 '20 at 00:19