roy@phri.UUCP (02/01/87)
Can somebody give me a good definition of "being logged in"? We've
got a 4.2BSD Vax and a bunch of Sun 3.1 Sun-3's, each of which seem to have
a different idea of what it means to be logged in.
On a Sun workstation, if you run w, it shows you being logged in
multiple times, once for each window (just the windows running shells, I
think). W also has a tendency not to realize when you log out -- I think
as long as a pty doesn't get reused, w still thinks you are logged in
there. On the other hand, w on the Sun correctly shows people who are
logged in via network connections (rlogin or telnet), while the Vax seems
to ignore those. Running who or last on the Vax also misses the network
logins, but lastcomm records commands run on network login connections and
when you login, the "Last login:" message does take into account network
connections.
Moving on to rwho, we see that the Sun file servers properly report
the number of people who are logged in (either on the console or via the
network), while the Vax only reports serial line logins, missing the
network connections, and the diskless Suns always show 0 people logged,
regardless of how they are connected (I'm not sure about logins directly on
the serial ports, tty[ab]). All machines seem to get the load and uptime
stats out, so I assume rwhod is running OK.
As it stands now, it seems that the concept of "being logged in"
depends on a variety of things: process ownership, tty/pty ownership,
presence or absence of a controlling tty, and entries made in various
accounting files during login and logout. Various programs seem to look at
different subsets of these to glean their information. Consider the
following situations:
1) On a tty, running a shell
2) On a tty running something like uucico.
3) On a pty, running rlogin or telnet, or an interactive rsh.
4) On a pty, using some sort of interactive LAT protocol.
5) On the console of a workstation running a shell and/or suntools.
6) On a non-pty socket running ftp.
7) Running a shell in a window.
8) On a non-pty socket, executing a remote command via rsh.
9) On a non-pty socket, doing rcp, rmt, yp, finger, syslog, SMTP, etc.
10) Talking NFS (or RFS, etc).
11) Going through a machine used as a terminal concentrator.
12) A process running on a tty not for a person (lpr, berknet, SLIP)
I would consider the 1-5 to be logged in, and 7-12 not. 6 is a bit
hazy, but I think I would put it in the first category. The essential
things seems to be that a) you are doing something interactive and b) you
went through some sort of username/password authentication. Rlogin will
let you bypass the authentication procedure if you have your network set up
right (although security-minded folks would call it just the opposite), but
it still looks like a login and feels like a login, so it would be silly to
call it anything else.
Any comments?
--
Roy Smith, {allegra,cmcl2,philabs}!phri!roy
System Administrator, Public Health Research Institute
455 First Avenue, New York, NY 10016
"you can't spell deoxyribonucleic without unix!"guy@gorodish.UUCP (02/02/87)
> Can somebody give me a good definition of "being logged in"? The problem is less one of a good definition of "being logged in" than one of which programs should report login sessions and which should report multiple windows belonging to the same session. > On a Sun workstation, if you run w, it shows you being logged in >multiple times, once for each window (just the windows running shells, I >think). I consider this not to be unreasonable behavior; you could, for example, have two jobs running in two different windows, and "w" should report the activity of both jobs. Also, if "w" just reported login sessions, the idle time it reports would be that of "/dev/console", which is often not very meaningful (when inside the window system, "/dev/console" is usually idle). Of course, one problem with this is that if you have a window with no associated pseudo-tty (say an EMACS window with no shell window), it doesn't show up. >W also has a tendency not to realize when you log out -- I think >as long as a pty doesn't get reused, w still thinks you are logged in >there. "w" prints a line for every seemingly-active line in the "utmp" file. SunView should be clearing lines out whenever a window is closed; if it's not, there's some sort of problem. >On the other hand, w on the Sun correctly shows people who are >logged in via network connections (rlogin or telnet), while the Vax seems >to ignore those. Running who or last on the Vax also misses the network >logins, but lastcomm records commands run on network login connections and >when you login, the "Last login:" message does take into account network >connections. This sounds like either a bug or a setup problem on the VAX side. Did you put an entry for each pseudo-terminal into "/etc/ttys"? If not, that could explain it. "login" has to know where to put the "utmp" entry; it does this by calling "ttyslot" which looks the current terminal up in "/etc/ttys". If it doesn't find it, "login" just doesn't bother recording the session in "/etc/utmp" or "/usr/adm/wtmp", which would explain why the session doesn't show up with "who" or "last". "lastcomm" records every single command run on the system, if you turn accounting on; when a process exits, the kernel writes a record to the accounting file. This is independent of the terminal from which the command is run; it even works if the command isn't run from a terminal. "login" will record the login time in "/usr/adm/lastlog" even if it doesn't find the entry in "/etc/ttys", which is why the "Last login" time is updated. > Moving on to rwho, we see that the Sun file servers properly report >the number of people who are logged in (either on the console or via the >network), while the Vax only reports serial line logins, missing the >network connections, Which could also be explained by an incomplete "/etc/ttys" on the VAX; "rwho" just reads the "utmp" file and broadcasts its findings. > I would consider the 1-5 to be logged in, and 7-12 not. 6 is a bit >hazy, but I think I would put it in the first category. I tend to agree, except in the case of "w", where I'd argue it should print something for each window. On a Sun, "sessions" in categories 1-5 and 7 get entries in "/etc/utmp", and none of the others do. There is a macro in <utmp.h> called "nonuser" which distinguishes category 7 from categories 1-5; it assumes that any pseudo-tty that has a session listed for it in "/etc/utmp" is either being used for a tty subwindow or a network login, and therefore that if there's no host name it must be a tty subwindow. I'm considering modifying "who" and "finger" to use "nonuser" (note: the "rusers" RPC service, which the "rusers" command uses, also uses "nonuser", so if you do "rusers <host>" it won't report tty windows). "finger"'s behavior is just stupid now; it tells you more-or-less the same information N times.
lrj@batcomputer.UUCP (02/03/87)
In article <12526@sun.uucp> guy@sun.UUCP (Guy Harris) writes: >>W also has a tendency not to realize when you log out -- I think >>as long as a pty doesn't get reused, w still thinks you are logged in >>there. >"w" prints a line for every seemingly-active line in the "utmp" file. >SunView should be clearing lines out whenever a window is closed; >if it's not, there's some sort of problem. This was a bug under SunOS 3.0 which appears fixed under SunOS 3.2 The /etc/utmp entries were not being cleaned up by Suntools when it exitted. It also seems that the 3.0 bug of Suntools leaving window sizes hanging around in a tty struct for innocent people using rlogin has been fixed. -- Lewis R. Jansen, LASSP Systems Grunt lrj@lasspvax.tn.cornell.edu