Linux Lessons - Killing rival user sessions via terminal

[shadow_man]

http://jerome.co.za/nix-tips-killing-old-shell-sessions/

*NIX TIPS – KILLING OLD SHELL SESSIONS

Perhaps you’ve been hacked and need to boot the rogue user off your server

or

Perhaps you want to kick off a colleague who’s influencing your session and prohibiting your work.

To check who’s logged in:

use:

who
root@server:/nas/file_storage# who
root pts/0 2014-01-06 10:36 (ws2.host.local)
root pts/1 2014-01-08 16:23 (ws2.host.local)

or

finger
root@server:/nas/file_storage# finger
Login Name Tty Idle Login Time Office Office Phone
root root *pts/0 14d Jan 6 10:36 (ws2.host.local)
root root *pts/1 23:43 Jan 8 16:23 (ws2.host.local)
root root *pts/2 Jan 13 17:25 (ws2.host.local)

Now you’ll see the results mention session numbers e.g. pts/0 BUT they don’t mention process id’s – so how do we kill their sessions?

Well we do this by:

ps -ft pts/0
root@server:/nas/file_storage# ps -ft pts/0
UID PID PPID C STIME TTY TIME CMD
root 32247 32109 0 Jan06 pts/0 00:00:02 -bash

Take note of the PPID and kill the session:

kill -9 32109

Now, you’ve gotten rid of the rogue users SSH session and can continue in peace.

 

[Rocket-Boy]

I find it easier to just use:
skill -KILL pts/0
Works on all the linux distros I have used, but the ps method works too.

 

[patrick123]

That just kills the currrent session but does not stop them from logging back on again. You need to identify their IP address and block that range of IP's from accessing your server while you tighten things up.

 

[shadow_man]

That just kills the currrent session but does not stop them from logging back on again. You need to identify their IP address and block that range of IP's from accessing your server while you tighten things up.

Sure however this was just written in mind with 2 admins sharing a machine and 1 admin making changes not knowing the other is online, thus breaking config etc.

 

[itareanlnotani]

whowatch is also useful.

Shows the pid's and you can terminate from that. Included in a lot of distro's by default, or an apt-get/yum update away..