4

This is result of who -uH:

NAME     LINE         TIME             IDLE          PID COMMENT
me    :0           2013-08-29 01:29   ?          1686 (:0)
me    pts/0        2013-08-29 01:42  old         2905 (:0)
me    pts/1        2013-08-29 01:45  old         2905 (:0)
me    pts/2        2013-08-29 01:52  old         2905 (:0)
me    pts/3        2013-08-29 02:26  old         2905 (:0)
me    pts/4        2013-08-30 18:37 00:07        2905 (:0)
me    pts/5        2013-08-29 10:34  old         2905 (:0)
me    pts/6        2013-08-29 11:05  old         2905 (:0)
me    pts/7        2013-08-29 13:34  old         2905 (:0)
me    pts/8        2013-08-30 15:56 02:45        2905 (:0)
me    pts/9        2013-08-30 18:27 00:17        2905 (:0)
me    pts/10       2013-08-30 17:34   .          2905 (:0)
me    pts/11       2013-08-30 17:37 00:13        2905 (:0)
me    pts/12       2013-08-30 18:28 00:17        2905 (:0)
me    pts/13       2013-08-30 18:38 00:07        2905 (:0)

Why it lists my username in 15 lines? How do I know If someone has connected to my system remotely?

nik.1
  • 345

4 Answers4

6

Terminal details

It lists a user for each physical and virtual terminal that they have.

  • virtual, aka. pseudo terminals (pts#)
  • physical, (:0 and/or tty#)

NOTE: The # above is an actual number like 1,2,3,etc.

Every time you open a tab in gnome-terminal counts as a virtual terminal. Logged into your system using tty terminals. These are accessible using the key combination: Control + Alt + Fn#.

Example

$ w
 10:37:37 up 8 days, 21:05, 11 users,  load average: 2.24, 2.08, 2.13
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
saml     tty2     -                10:33    3:47   0.12s  0.12s -bash
saml     tty1     :0               21Aug13  9days 16:07m  0.02s pam: gdm-password
saml     pts/0    :0.0             21Aug13  9:57m  0.37s  0.37s bash
saml     pts/1    :0.0             21Aug13  8days  0.28s  0.28s bash
saml     pts/6    :0.0             21Aug13 36:23m  3.16s  3.16s bash
saml     pts/9    :0.0             22Aug13 33:52m  5.92s  5.92s bash
saml     pts/13   :0.0             Tue12   39:53m  2:37   2:37  irb                                                
saml     pts/27   :0.0             03:15    7:12m  0.21s  0.21s bash
saml     pts/28   :0.0             08:42    0.00s  0.18s  0.00s w
saml     pts/29   :0.0             10:36    8.00s  0.18s  0.01s ssh catbus
saml     pts/30   192.168.1.200    10:37    3.00s  0.14s  0.14s -bash

Notes

  1. My X server is running on tty1, the :0 shows where I'm connecting from to this terminal. :0 and :0.0 mean the primary X server.

  2. The above is telling you that I have 2 tty terminals open + 7 virtual ones.

  3. The last line demonstrates what a user shows up as when using ssh to remote into the system. You can see the IP address from where they're coming from.

For completeness here's my output from who -uH:

$ who -uH
NAME     LINE         TIME             IDLE          PID COMMENT
saml     tty2         2013-08-30 10:33 00:18        1735
saml     tty1         2013-08-21 13:33  old         2008 (:0)
saml     pts/0        2013-08-21 13:35 10:12        3240 (:0.0)
saml     pts/1        2013-08-21 13:47  old         3240 (:0.0)
saml     pts/6        2013-08-21 15:21  old         3240 (:0.0)
saml     pts/9        2013-08-22 09:37  old         3240 (:0.0)
saml     pts/13       2013-08-27 12:14  old         3240 (:0.0)
saml     pts/27       2013-08-30 03:15 07:27        3240 (:0.0)
saml     pts/28       2013-08-30 08:42   .          3240 (:0.0)
saml     pts/29       2013-08-30 10:36 00:15        3240 (:0.0)
saml     pts/30       2013-08-30 10:37 00:15       14092 (192.168.1.200)
slm
  • 369,824
2

That's because you probably have 14 terminals open (the 15th is your GUI session). If you had been logged in remotely, you would have seen a line like this:

me   pts/11   localhost        16:36    1:13   0.18s  0.18s -bash

You may also be interested in w:

$ w
 16:36:38 up 22:47, 13 users,  load average: 0.29, 0.33, 0.40
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
terdon tty8     :0               Thu17   20:47m 59:36   1.61s gnome-session -
terdon pts/0    :0               13:58    1:06m  0.18s  0.18s /bin/bash
terdon pts/1    :0               14:01    2:34m  0.03s  0.03s ssh -Yp 24222 c
terdon pts/3    :0               Thu18   15:36   1.23s  1.23s /bin/bash
terdon pts/4    :0               15:40   10:25   3.94s  0.23s /bin/bash
terdon pts/5    :0               16:33    0.00s  0.18s  0.01s w
terdon pts/6    :0               14:55   38:51   0.33s  6.38s /usr/bin/python
terdon pts/7    :0               16:35   20.00s  0.23s  0.02s ssh terdon@oreg
terdon pts/8    :0               Thu20   19:40m  0.19s  0.19s /bin/bash
terdon pts/10   :0               16:00   35:23   0.26s  0.26s /bin/bash
terdon pts/12   :0               16:22   14:13   0.16s  0.16s /bin/bash
terdon pts/13   :0               16:23   13:05   0.27s  0.27s /bin/bash
terdon   pts/11   localhost        16:36   17.00s  0.18s  0.18s -bash

Note the line where WHAT is ssh terdon@oreg.

terdon
  • 242,166
1

Each line corresponds to one shell session; every time you open a new terminal, you create a new "pseudo-terminal slave" (pts). If you are remotely logged, the last (:0) (which corresponds to your local hostname) will be replaced by your ip (or your hostname).

MBR
  • 954
1

It looks like you have 14 terminals open, and you show up once for each of them and once for being logged in. If someone logs in remotely the last column will have a hostname in it. For example here is my who output when I am sshd in from another computer:

awlayton tty7         2013-08-29 10:01 (:0)
strat    pts/0        2013-08-29 10:01 (:25)
awlayton pts/1        2013-08-29 10:06 (:0)
awlayton pts/2        2013-08-29 13:15 (:0)
awlayton pts/4        2013-08-30 10:35 (:0)
awlayton pts/5        2013-08-30 10:35 (chives.ecn.purdue.edu)

As you can see, someone (me) is logged in remotely from a computer called chives.ecn.purdue.edu. I also show up multiple times locally because I have terminals open.

Alex Layton
  • 181