How do you kick a benign user off your system?

Question

I was googling this a bit ago and noticed a couple of ways, but I'm guessing that google doesn't know all. So how do you kick users off your Linux box? also how do you go about seeing they are logged in in the first place? and related... does your method work if the user is logged into an X11 DE (not a requirement I'm just curious)?

Answer 1

There's probably an easier way, but I do this:

1. See who's logged into your machine -- use who or w:

   > who  
   mmrozek  tty1         Aug 17 10:03  
   mmrozek  pts/3        Aug 17 10:09 (:pts/2:S.0)
   

2. Look up the process ID of the shell their TTY is connected to:

   > ps t  
   PID   TTY      STAT   TIME COMMAND  
   30737 pts/3    Ss     0:00 zsh
   

3. Laugh at their impending disconnection (this step is optional, but encouraged)

   > echo "HAHAHAHAHAHAHAHA" | write mmrozek pts/3
   

4. Kill the corresponding process:

   > kill -9 30737
   

---

I just discovered you can combine steps 1 and 2 by giving who the -u flag; the PID is the number off to the right:

> who -u
mmrozek  tty1         Aug 17 10:03 09:01        9250
mmrozek  pts/18       Aug 17 10:09 01:46       19467 (:pts/2:S.0)

Answer 2

As Micheal already pointed out, you can use who to find out who's logged in. However if they have multiple processes, there's a more convenient way than killing each process individually: you can use killall -u username to kill all processes by that user.

Answer 3

Logout the user 'username':

skill -KILL -u username

See man skill

Answer 4

Other useful command is pkill here pkill -u username && pkill -9 -u username. killall have disadvantage that on Solaris IIRC it means something completely different - also pkill have slightly more advanced options.

Answer 5

First of all, this indicates a larger problem. If you have users that you don't trust on your system, you should probably level it and re-image.

With that in mind, you can do some or all of the following:

# set up the environment
$ BADUSER=foo # where foo is the username in question
$ USERLINE=`grep '^$BADUSER:' /etc/passwd`
$ BADUID=`echo $USERLINE | awk -F: '{print $3}'`
$ BADGID=`echo $USERLINE | awk -F: '{print $4}'`
$ BADHOMEDIR=`echo $USERLINE | awk -F: '{print $6}'`

# disable the user's future login
$ sudo chsh -s /bin/false $BADUSER

# kill all of the user's processes
$ BADPROCS=`ps auwx | grep '^$BADUSER ' | awk '{print $2}'`
$ sudo kill -9 $BADPROCS

# back up/clear the user's home directory
$ mkdir -p ~/backup/home-backup/
$ sudo tar -cfj ~/backup/home-backup/$BADUSER-`date +%F`.tar.bz2 $BADHOMEDIR
$ sudo rm -rf $BADHOMEDIR/.* $BADHOMEDIR/*

# find all files owned by user
$ sudo find / -user $BADUSER > ~/backup/$BADUSER-files-`date +%F`.txt

# remove user
$ sudo userdel $BADUSER

Answer 6

Necromancy!

I appreciate the humor of the accepted answer, but professionally I can't advocate it.

The most graceful method I'm aware of is to send a -HUP to the shell to simulate a user hangup. You can send this to the user's idle sshd to simulate their connection being lost, which triggers a cleanup of the entire shell environment, or send this to specific nested shells (say, ones setting inside of a disconnected terminal multiplexer that are keeping you from unmounting a filesystem) if you want to be really precise.

Using write to send messages to terminally idle ptys before you boot them is a fun hobby though.