who的输出问题

最新推荐文章于 2021-05-19 10:02:40 发布

ruiqingzheng

最新推荐文章于 2021-05-19 10:02:40 发布

阅读量791

点赞数

分类专栏： LINUX

本文链接：https://blog.csdn.net/ruiqingzheng/article/details/8675707

版权

LINUX 专栏收录该内容

61 篇文章 0 订阅

订阅专栏

居然发现who 一看 N个root在系统中汗啊~！

[root@localhost log]# last | tac 的输出
root     pts/3                         Sun Jan 15 18:17 - 18:17 (00:00)
root     pts/3        :2.0             Sun Jan 15 18:17 - 23:12 (2+04:54)
root     pts/6                         Sun Jan 15 18:28 - 18:28 (00:00)
root     pts/6        :4.0             Sun Jan 15 18:28 - 23:12 (2+04:44)

[root@localhost log]# who
root     pts/2        Jan 15 18:06 (:1.0)
root     pts/4        Jan 15 18:09
root     pts/5        Jan 15 18:10 (:1.0)
root     pts/3        Jan 15 18:17 (:2.0)
root     pts/6        Jan 15 18:28 (:4.0)

找来找去没发现什么异常
google一下还好

who command shows more users than actual exists?

Often this means that your utmp file is corrupted. When files like
that go bad, different commands interpret them differently.

Most likely, because there's something in some of your login/logout
procedures that corrupts the file sometimes.

Can I simply delete utmp? will it recreate itself?

Just truncate it to size zero .

> /var/run/utmp
who
没有输出了

重新登陆后正常

> root       169 0.0 0.5 1148 644 ?        S    08:23   0:00 /sbin/rpc.statd

Do you use NFS? If not, get rid of this.

> root       193 0.0 0.4 1300 552 ?        S    08:23   0:00 /usr/sbin/inetd

I assume you use this for telnet and FTP. Make sure other services are
commented out in /etc/inetd.conf.

> root       201 0.0 0.4 1352 560 ?        S    08:23   0:00 /usr/sbin/lpd

Do you print from this machine? If not, get rid of this.

> nobody     256 0.0 2.0 3616 2596 ?        S    08:23   0:00 /usr/bin/X11/xfs-xtt -user nobody

Don't really need font serving on a colo box.

> root       260 0.0 1.2 1556 1548 ?        SL   08:23   0:00 /usr/sbin/ntpd

Do you use this? I think it's for time synchronization serving, though
it might be a client. Maybe try rdate if you just need a client.

> daemon     265 0.0 0.4 1140 544 ?        S    08:23   0:00 /usr/sbin/atd

If you don't use this, get rid of it. Malicious users can schedule
tasks for when they're not logged in.

Just a couple thoughts on ways to tighten things.

阅读(667) | 评论(0) | 转发(0) |

上一篇：使用getopts获取命令行参数

下一篇：OReilly - 《Unix Sed Awk》和《sed and awk Po》第二版下载