Do I have hidden users on my system?

[tckosvic]

In following another thread, I ran the command below:

"inxi -F"

At the end of the output from that command, there was an info section, shown below:

Info:
  Processes: 396  
  Uptime: 07:39:40  up 4 days 17:19,  3 users,  load average: 2.36, 4.32, 4.56  
  Memory: 31.27 GiB used: 12.47 GiB (39.9%) Shell: bash inxi: 3.1.00

The info section says there are 3 users. I have only one user as confirmed in yast, User and Group Management. Also. /home directory shows only 1 user.

Is it possible that somehow hidden users got installed on my system? I sure hope not.

Thanks for any insights into this query, tom kosvic

[malcolmlewis]

In following another thread, I ran the command below:

"inxi -F"

At the end of the output from that command, there was an info section, shown below:

Info:
  Processes: 396  
  Uptime: 07:39:40  up 4 days 17:19,  3 users,  load average: 2.36, 4.32, 4.56  
  Memory: 31.27 GiB used: 12.47 GiB (39.9%) Shell: bash inxi: 3.1.00

The info section says there are 3 users. I have only one user as confirmed in yast, User and Group Management. Also. /home directory shows only 1 user.

Is it possible that somehow hidden users got installed on my system? I sure hope not.

Thanks for any insights into this query, tom kosvic

Hi
From the terminal your running inxi also run the command `who`.

[tckosvic]

(base) tom@mydesktop:~> who
tom
(base) tom@mydesktop:~>

who command shows 1 user who I know.

[arvidjaar]

I always found this amusing - everyone on this forum requests inxi output and apparently no one actually knows how to interpret it.

Is not this a question to inxi support forum - what exactly "users" means and how this program computes this number? Besides if these users are counted, they are not hidden, right? Anyway

$ ps --no-headers -eo user | sort -u | wc -l
13
$

I am the single user on this system, yet there are processes belonging to 12 other users here. Which are various system services. Check the list of processes to see if there is some unexpected user, check loginctl to see if there are some other login sessions. But again - unless you know exactly what inxi reports, any further steps are pretty pointless.

[arvidjaar]

what exactly "users" means and how this program computes this number?

OK, it looks like the straight "uptime" output in which case it comes from utmp. Can you post "utmpdump /run/utmp"?

[hcvv]

The users configured in your system are as such in /etc/passwd. A text file with one line per user. Thus counting the lines gives you the number of users:

wc -l /etc/passwd

But when you are curious you can of course also look inside /etc/passwd,


I have no idea what you mean with "hidden", but I am not aware of any configuration parameter in /etc/passwd that makes a difference between "hidden" and "not hidden".

[larryr]

you can see what "users" are on you system with this command (ignore the UID - it is part of the ps -ef command output).

ney@VM1:~> ps -ef | awk '{print $1}' | sort | uniq 
avahi
ney
message+
nscd
ntp
polkitd
postfix
root
rtkit
UID
vscan
ney@VM1:~>

[nrickert]

In following another thread, I ran the command below:

"inxi -F"

At the end of the output from that command, there was an info section, shown below:

When I run that "inxi" command here, it does not show a count of users. However, this is Leap 15.4 Beta.

If I run the "uptime" command, it shows 5 users. They are all me (as shown by the "who" command):

% who
rickert  :            2022-05-12 18:33 (:)
rickert  :0           2022-05-12 18:33 (:0)
rickert  pts/0        2022-05-12 18:33 (:0)
rickert  pts/1        2022-05-12 18:33 (:0)
rickert  pts/2        2022-05-12 18:35 (:0)

The user at "pts/1" is because I have a xterm open (to run that "inxi" command, for example).
The user at "pts/2" is my Yakuake drop down terminal.
The remaining 3 users seem to be associated with my X11 session. As mentioned by arvidjaar, they are the entries from the utmp database.

[malcolmlewis]

When I run that "inxi" command here, it does not show a count of users. However, this is Leap 15.4 Beta.

If I run the "uptime" command, it shows 5 users. They are all me (as shown by the "who" command):

% who
rickert  :            2022-05-12 18:33 (:)
rickert  :0           2022-05-12 18:33 (:0)
rickert  pts/0        2022-05-12 18:33 (:0)
rickert  pts/1        2022-05-12 18:33 (:0)
rickert  pts/2        2022-05-12 18:35 (:0)

The user at "pts/1" is because I have a xterm open (to run that "inxi" command, for example).
The user at "pts/2" is my Yakuake drop down terminal.
The remaining 3 users seem to be associated with my X11 session. As mentioned by arvidjaar, they are the entries from the utmp database.

Hi
The last command will show more detail, in your case `last -n 5`.

[karlmistelberger]

erlangen:~ # who -m 
karl     pts/2        May 15 08:22 (:0) 
erlangen:~ #

erlangen:~ # who -l 
LOGIN    tty1         May 15 06:36              1014 id=tty1 
LOGIN    tty2         May 15 16:54             13465 id=tty2 
erlangen:~ #

erlangen:~ # who -d 
         pts/1        May 15 08:22              1630 id=ts/1  term=0 exit=0 
         pts/1        May 15 14:05             21697 id=/1    term=0 exit=0 
erlangen:~ #

erlangen:~ # who -T 
karl     + tty7         May 15 06:36 (:0) 
karl     + pts/0        May 15 06:36 (:0) 
karl     - pts/2        May 15 08:22 (:0) 
karl     - pts/3        May 15 08:23 (:0) 
root     + pts/4        May 15 15:03 (xxxx:xxx:xxx:xxxx:xxxx:xxxx:xxxx:xxx) 
erlangen:~ #

erlangen:~ # who -q 
karl karl karl karl 
# users=4 
erlangen:~ #

erlangen:~ # ps --no-headers -eo user | sort -u 
chrony 
fetchmail 
karl 
messagebus 
minidlna 
polkitd 
postfix 
root 
rtkit 
systemd-network 
systemd-resolve 
wwwrun 
erlangen:~ #