7

In a RHEL 7.3 server, I was trying to find logged-in users. I ran w and it told me there were two users, but it only showed me the info of one (myself); then I ran who, which displayed the other user as (unknown). Finally, I ran lastlog, with which's output I could match the log in date and port from who's output and find the unknown user actually is gdm.

$ w
 09:33:36 up 4 days, 15:22,  2 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
myusr     pts/0    172.16.23.113    09:32    0.00s  0.06s  0.03s w

$ who
(unknown) :0           2017-07-01 18:13 (:0)
myusr     pts/0        2017-07-06 09:32 (172.16.23.113)

$ lastlog 
Username         Port     From             Latest
...
gdm              :0                        Sat Jul  1 18:13:23 -0500 2017
...

The server is a supermicro machine and from time to time I connect to it using IPMI2's kvm over lan feature. But I don't remember anything weird happening when connecting like that.

This doesn't seem normal. What could have happened?

7
  • 1
    Keep in mind, based on info coreutils 'who invocation' the who command just outputs the content of /var/run/utmp, which is supposed to reflect the current sessions. who is not really responsible for the content it outputs, it's just a clean way of showing it.
    – Centimane
    Jul 6, 2017 at 15:31
  • Someone had added an answer (now deleted) saying that a user without a shell in /etc/passwd would show as unknown. Do you, @Centimane (anybody), know anything about this?
    – Samuel
    Jul 6, 2017 at 16:35
  • 1
    It seems that answer was deleted based on my comment to it. who doesn't touch /etc/passwd at all, based on an strace -e trace=file who 2>&1 | grep etc
    – Centimane
    Jul 6, 2017 at 17:13
  • 1
    indeed it was a wild guess that I intended to check when I'll have a few spare time, Centimane corrected me before that so I deleted that wrong answer.
    – M4rty
    Jul 6, 2017 at 18:05
  • 2
    @M4rty Not all of the answer was wrong though, you were on the right track that the gdm login was being misinterpreted.
    – Centimane
    Jul 6, 2017 at 18:16

2 Answers 2

5

After reading Centimane's comment on /var/run/utmp and searching differently, I found this fedora forum thread, which mentioned the issue is provoked by a bug in GDM, which creates a bad entry in /var/run/utmp. Eventually I even found a bug report for it and another here.

2

It really seems like your unknown user is gdm and who somehow fail to interpret it.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .