Page 1 of 3 123 LastLast
Results 1 to 10 of 24

Thread: Do I have hidden users on my system?

  1. #1
    Join Date
    Apr 2011
    Location
    Texas USA
    Posts
    465

    Default Do I have hidden users on my system?

    In following another thread, I ran the command below:

    "inxi -F"

    At the end of the output from that command, there was an info section, shown below:

    Code:
    Info:
      Processes: 396  
      Uptime: 07:39:40  up 4 days 17:19,  3 users,  load average: 2.36, 4.32, 4.56  
      Memory: 31.27 GiB used: 12.47 GiB (39.9%) Shell: bash inxi: 3.1.00
    
    The info section says there are 3 users. I have only one user as confirmed in yast, User and Group Management. Also. /home directory shows only 1 user.

    Is it possible that somehow hidden users got installed on my system? I sure hope not.

    Thanks for any insights into this query, tom kosvic

  2. #2
    Join Date
    Jun 2008
    Location
    East of Podunk
    Posts
    33,099
    Blog Entries
    15

    Default Re: Do I have hidden users on my system?

    Quote Originally Posted by tckosvic View Post
    In following another thread, I ran the command below:

    "inxi -F"

    At the end of the output from that command, there was an info section, shown below:

    Code:
    Info:
      Processes: 396  
      Uptime: 07:39:40  up 4 days 17:19,  3 users,  load average: 2.36, 4.32, 4.56  
      Memory: 31.27 GiB used: 12.47 GiB (39.9%) Shell: bash inxi: 3.1.00
    
    The info section says there are 3 users. I have only one user as confirmed in yast, User and Group Management. Also. /home directory shows only 1 user.

    Is it possible that somehow hidden users got installed on my system? I sure hope not.

    Thanks for any insights into this query, tom kosvic
    Hi
    From the terminal your running inxi also run the command `who`.
    Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890)
    SUSE SLE, openSUSE Leap/Tumbleweed (x86_64) | GNOME DE
    If you find this post helpful and are logged into the web interface,
    please show your appreciation and click on the star below... Thanks!

  3. #3
    Join Date
    Apr 2011
    Location
    Texas USA
    Posts
    465

    Default Re: Do I have hidden users on my system?

    Code:
    (base) tom@mydesktop:~> who
    tom
    (base) tom@mydesktop:~>
    
    who command shows 1 user who I know.

  4. #4
    Join Date
    Sep 2012
    Posts
    7,678

    Default Re: Do I have hidden users on my system?

    I always found this amusing - everyone on this forum requests inxi output and apparently no one actually knows how to interpret it.

    Is not this a question to inxi support forum - what exactly "users" means and how this program computes this number? Besides if these users are counted, they are not hidden, right? Anyway
    Code:
    $ ps --no-headers -eo user | sort -u | wc -l
    13
    $
    I am the single user on this system, yet there are processes belonging to 12 other users here. Which are various system services. Check the list of processes to see if there is some unexpected user, check loginctl to see if there are some other login sessions. But again - unless you know exactly what inxi reports, any further steps are pretty pointless.

  5. #5
    Join Date
    Sep 2012
    Posts
    7,678

    Default Re: Do I have hidden users on my system?

    Quote Originally Posted by arvidjaar View Post
    what exactly "users" means and how this program computes this number?
    OK, it looks like the straight "uptime" output in which case it comes from utmp. Can you post "utmpdump /run/utmp"?

  6. #6
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    30,694

    Default Re: Do I have hidden users on my system?

    The users configured in your system are as such in /etc/passwd. A text file with one line per user. Thus counting the lines gives you the number of users:
    Code:
    wc -l /etc/passwd
    But when you are curious you can of course also look inside /etc/passwd,


    I have no idea what you mean with "hidden", but I am not aware of any configuration parameter in /etc/passwd that makes a difference between "hidden" and "not hidden".
    Henk van Velden

  7. #7
    Join Date
    Jul 2018
    Location
    Loma Linda, Mo
    Posts
    737

    Default Re: Do I have hidden users on my system?

    you can see what "users" are on you system with this command (ignore the UID - it is part of the ps -ef command output).
    Code:
    ney@VM1:~> ps -ef | awk '{print $1}' | sort | uniq 
    avahi
    ney
    message+
    nscd
    ntp
    polkitd
    postfix
    root
    rtkit
    UID
    vscan
    ney@VM1:~>
    OpenSUSE 15.3 with VirtualBox VM's (XP, 10, 11, Ubuntu MATE 22.04, OpenSUSE 15.3, Tumbleweed)
    Pi4 with OpenSUSE 15.3
    Unix since 1974 (pdp-11, Interdata, AT&T, Tandy, Convergent, Sun, IBM, NCR, and HP)
    Linux since 1995 (Mandrake, Fedora, CentOS, OpenSUSE)

  8. #8
    Join Date
    Aug 2010
    Location
    Chicago suburbs
    Posts
    15,984
    Blog Entries
    3

    Default Re: Do I have hidden users on my system?

    Quote Originally Posted by tckosvic View Post
    In following another thread, I ran the command below:

    "inxi -F"

    At the end of the output from that command, there was an info section, shown below:
    When I run that "inxi" command here, it does not show a count of users. However, this is Leap 15.4 Beta.

    If I run the "uptime" command, it shows 5 users. They are all me (as shown by the "who" command):
    Code:
    % who
    rickert  :            2022-05-12 18:33 (:)
    rickert  :0           2022-05-12 18:33 (:0)
    rickert  pts/0        2022-05-12 18:33 (:0)
    rickert  pts/1        2022-05-12 18:33 (:0)
    rickert  pts/2        2022-05-12 18:35 (:0)
    The user at "pts/1" is because I have a xterm open (to run that "inxi" command, for example).
    The user at "pts/2" is my Yakuake drop down terminal.
    The remaining 3 users seem to be associated with my X11 session. As mentioned by arvidjaar, they are the entries from the utmp database.
    openSUSE Leap 15.4; KDE Plasma 5.24.4;
    testing Tumbleweed.

  9. #9
    Join Date
    Jun 2008
    Location
    East of Podunk
    Posts
    33,099
    Blog Entries
    15

    Default Re: Do I have hidden users on my system?

    Quote Originally Posted by nrickert View Post
    When I run that "inxi" command here, it does not show a count of users. However, this is Leap 15.4 Beta.

    If I run the "uptime" command, it shows 5 users. They are all me (as shown by the "who" command):
    Code:
    % who
    rickert  :            2022-05-12 18:33 (:)
    rickert  :0           2022-05-12 18:33 (:0)
    rickert  pts/0        2022-05-12 18:33 (:0)
    rickert  pts/1        2022-05-12 18:33 (:0)
    rickert  pts/2        2022-05-12 18:35 (:0)
    The user at "pts/1" is because I have a xterm open (to run that "inxi" command, for example).
    The user at "pts/2" is my Yakuake drop down terminal.
    The remaining 3 users seem to be associated with my X11 session. As mentioned by arvidjaar, they are the entries from the utmp database.
    Hi
    The last command will show more detail, in your case `last -n 5`.
    Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890)
    SUSE SLE, openSUSE Leap/Tumbleweed (x86_64) | GNOME DE
    If you find this post helpful and are logged into the web interface,
    please show your appreciation and click on the star below... Thanks!

  10. #10
    Join Date
    Jan 2014
    Location
    Erlangen
    Posts
    3,837

    Default Re: Do I have hidden users on my system?

    Code:
    erlangen:~ # who -m 
    karl     pts/2        May 15 08:22 (:0) 
    erlangen:~ #
    Code:
    erlangen:~ # who -l 
    LOGIN    tty1         May 15 06:36              1014 id=tty1 
    LOGIN    tty2         May 15 16:54             13465 id=tty2 
    erlangen:~ #
    Code:
    erlangen:~ # who -d 
             pts/1        May 15 08:22              1630 id=ts/1  term=0 exit=0 
             pts/1        May 15 14:05             21697 id=/1    term=0 exit=0 
    erlangen:~ #
    Code:
    erlangen:~ # who -T 
    karl     + tty7         May 15 06:36 (:0) 
    karl     + pts/0        May 15 06:36 (:0) 
    karl     - pts/2        May 15 08:22 (:0) 
    karl     - pts/3        May 15 08:23 (:0) 
    root     + pts/4        May 15 15:03 (xxxx:xxx:xxx:xxxx:xxxx:xxxx:xxxx:xxx) 
    erlangen:~ #
    Code:
    erlangen:~ # who -q 
    karl karl karl karl 
    # users=4 
    erlangen:~ #
    Code:
    erlangen:~ # ps --no-headers -eo user | sort -u 
    chrony 
    fetchmail 
    karl 
    messagebus 
    minidlna 
    polkitd 
    postfix 
    root 
    rtkit 
    systemd-network 
    systemd-resolve 
    wwwrun 
    erlangen:~ #
    i7-6700K (2016), i5-8250U (2018), AMD Ryzen 5 3400G (2020), 5600X (2022) openSUSE Tumbleweed, KDE Plasma

Page 1 of 3 123 LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •