Suppose, the user does su, switching to root

$ su
bash-4.2# crontab -l

How can I logout all such users from root at a certain time?

What I tried

I know, that using this command:

bash-4.2# ps -A -u root | grep bash
 2303 tty1     00:00:00 bash
 2548 pts/0    00:00:00 bash
 3040 pts/0    00:00:00 bash
 3080 pts/2    00:00:00 bash

we can get all the Bash shells, owned by root. But how can I select the one that was generated by su? When I ran echo $$ in the su-ed shell, it gives this:

bash-4.2# echo $$

Then I tried:

bash-4.2# kill 3040

But it didn't kill the root shell. Plus if I create a cron job echo $$ it won't give the necessary PID. So, this won't work.

Now I'm stuck.

  • You must have security problems that transcend this one, because your having a lot of sudo'ed users can be indicative of other problems. Setup a script that immediately forks a child. The child sleeps n seconds. It then does a kill -15 $PPID (or whatever is SIGTERM on your system) and exits. – jim mcnamara Nov 29 '13 at 4:20
  • 4
    This sounds like an XY problem. Why do you need this? Are you running su in a cronjob? – terdon Nov 29 '13 at 4:20
  • @terdon +1 this was what I wanted to say, more succinctly. Thanks. – jim mcnamara Nov 29 '13 at 4:22

pkill -u 0 su alls all su processes running as root (which in turn kills their child shells).

If you only want to kill the bash processes running under su:

for pid in $(pgrep -u 0 bash); do
  parent_pid=$(ps -o ppid= -p "$pid")
  parent_command=$(ps -o comm= -p "$parent")
  if [ "$parent_command" = "su" ]; then kill -HUP "$parent_pid"; fi

That being said, this is probably a bad idea. What if that shell you're killing is doing something important?

If you want to kill shells that remain unattended for too long, set the TMOUT variable in .bashrc. For example, with TMOUT=600, bash automatically exits if it sees no input for 10 minutes.

Do think carefully about what you're trying to achieve. There's a good chance that killing shells won't solve whatever problem you're trying to solve.


As other states, it should not be needed. You should see first why there are many su processes actives.

On the other hand, to kill all those processes, e.g. under Linux you could use:

ps aux | awk '/su( -)?$/ {print $2}' | xargs sudo kill

If you don't care about killing off other su processes (su -u username) the simple approach will be

   echo "killall su" | at 1145 jan 31

If you care, use Emy's solution, feeding it to "at" for "a certain time" or adding it to crontab for periodic calls.

Note smartass users will overcome Emy's filter with su -u root and hunting them down will be hard as su takes quite a few options which could fool the regexp. killall is more foolproof, but may cause collateral damage as described above.


pkill (and possibly its companion pgrep) should work nicely, if indeed you really need to do this.

Something like pkill su will send a kill signal to all su processes. Also look at their --full parameter; see the man page for details.

To achieve the "at a certain time", the obvious solution is to use at, which is specifically designed to execute a given command at a given time and only then (as opposed to cron, which executes scheduled commands repeatedly when the system time matches some given criteria).

Putting them together, you get something like echo pkill su | at 17:30. Note that the at will have to be run as root.


To kill all bash processes, belonging to root, I used the following script:

for pid in $(pgrep -u 0 bash); do
    if [ "$pid" != "$$" ]; then
        kill -HUP "$pid";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.