Why is user wlo1 connecting to cockpit?

English Network/Internet
1

Hi All. I am not sure whether this is the right category, but I could not find any for this question.

I am using OpenSUSE 16.0 connected to the ethernet. Sometimes I use WI-FI, but not in the last few days.

My system was hanging, so I opened another console with CTRL-ALT-F1 and I noticed many logins by user wlo1 to the IP address of Cockpit. Why is that happening?

In the meantime I killed the process that was taking all the resources and I went back on the main console, I checked again after two hours and i saw two more logins.

I did not change the default firewall configuration, cockpit should be blocked to public space. The wireless is not connected.

2

When your system is hanging you can do nothing, not even a CTRL-ALT-F1. So better explain what you experienced.

Please explain (or better show here) what you saw (and not your conclusion that t is a login). And is userwlo1 a known user?

3

wlo1 is not a user on a normal system. It is the name of the first Wireless Local Area Netwiork Interface.

Cockpit itself does not have a IP adress. A physical/virtual machine has.

In the description are obviously different topics and terms mixed. It is unclear what “the process” is which got killed, and how and where “logins” were detected.

4

I cannot copy and paste because it is text that I see on the console. I copied the text manually, I replaced some hash or hex character sequences with dots. Anyway the following lines repeat many thimes:


Welcome to OpenSUSE Leap 16.0 - Kernel 6.12.0.160000.35-default(tty1)

emp3....... 192.168.100.2 fe00::....:....:....
wlo1:

web console http://192.168.100.2:9090/ or http://192.168.100.2:9090/

BTW I set now the computer in airplane mode and nothing changed, I see many more lines like that appearing. What is happening?

5

The first part was there only to explain why I opened tty1. The rest is about the messages I see on tty1

6

@CommonKnot That is normal, the issue generator does this for assistance to those whom login remotely over the likes of ssh, or switch to a tty. It’s not a login, it’s just a message and a login prompt.

AFAIK it can be disabled.

7

But why I see the login prompt repeating many times? It never happened before.

What does wlo1 has to do with the login prompt?
What does the web console address has to do with a login from tty?

8

Are you referring to this (I put an arrow pointing to it)

If yes, that is NOT a login prompt … that is simply the output related to network info … and usually, the colon ( : ) separates further output information (about the connection).

9

Are you referring to this

Actually not. The whole sequence posted above repeats many times.

10

Something is triggering the issue on tty1 to create a new (repeated) login prompt not a login.

As explained, it is the network interfaces being shown, for example here I see;

cat /etc/issue

Welcome to \S - Kernel \r (\l).

em1: \4{em1} \6{em1}
wlp3s0: \4{wlp3s0} \6{wlp3s0}

If you cat the above file and likely a cockpit file in /etc/issue.d/ directory you will see what it printed.

I see it here, am I worried, not really…

1 Like
11

Then you need to clarify this statement:
“But why I see the login prompt repeating many times?”

Computer prompts are not continually repeated every XXXX seconds.

I’ll assume what you’re seeing “repeated” is the output of some command (probably kernel) because it’s pinging for data from the device, over and over.

Run a system monitor and check what process is busy.
Many processes default to output to “stdout”

12

@CommonKnot … quick Reply here.

For fun, I did a CTRL-ALT-F1 and guess what … I see the EXACT same output on that tty that you show … well, except mine shows:

em2:
wlan0: 192.168.1.224 ...

Over and over … it’s output is related to when I logged into Cockpit yesterday. I’ll show it later (got errands to run).

It’s normal output … and it was being output to TTY1 , I’m actually using KDE Plasma, that’s running on TTY2.

13

Yes, that is the standard “Welcome to openSUSE Tumbleweed 2026xxyy - Kernel 7.1.3-default (ttyx)” (using Tumbleweed here…) message.
While it shows just once on tty2-tty6, it keeps repeating on tty1 for reasons unknown to me. But it was that way for as long as I can recall…

14

@CommonKnot … shopping done :slight_smile:

So, I have captured the output (only showing 1/2 of it) that I see on my tty1. The output is below.

And yea, it appears there are a number of login prompts.
The real login prompt is “machine login:”. That is a result of the login into Cockpit (not sure why it’s outputing that)

The others like: “em2:” and “wlan0:” are NOT.

I would like to mention, and for other folks watching … that you CAN capture what is displayed on TTY1 (all the text displayed).
Scroll down to the very bottom of my TTY1 output … see that “setterm …” command I executed - that captured the output ALREADY displayed on TTY1 to a
text file “txt-tty1.txt”.
(so folks do NOT have to take a photo of their TTY1 screen :+1: )

Hope it helps :+1:
.
The tty1 output:

machine login:
Welcome to openSUSE Leap 15.6 - Kernel 6.4.0-150600.23.103-default (tty1).

em2:
wlan0: 192.168.1.202

Web console: https://machine:9090/ or https://192.168.1.202:9090/

machine login:
Welcome to openSUSE Leap 15.6 - Kernel 6.4.0-150600.23.103-default (tty1).

em2:
wlan0: 192.168.1.202 

Web console: https://machine:9090/ or https://192.168.1.202:9090/

machine login:
Welcome to openSUSE Leap 15.6 - Kernel 6.4.0-150600.23.103-default (tty1).

em2:
wlan0: 192.168.1.202 

Web console: https://machine:9090/ or https://192.168.1.202:9090/

user@machine:~> su -l
Password:
machine:~ # setterm -dump 1 -file txt-tty1.txt
machine:~ #
15

But your topic is tagged “leap-16”.

People really want to know what you are using when they try to help :unamused: