Seeing user two times

Question

Consider I have created a user 'test' during Installation which I use to login to my system. My root user is 'root'. I further open two terminal sessions for each of the users respectively. Now the problem is when I type the 'w', 'who' or even the 'finger' command (in my root terminal session) to list all users logged in, I see the 'test' user coming in two times (with different TTYs), which should have actually been 'test' & 'root'. Even If I create a new user 'test1', I still see my original username name 'test' is being the output of w, who, finger commands for users currently logged in. Something like this: Why so?

PS.: Using RHEL7

Answer 1

New terminal window, I then use su - username to log in to the other user

This is your error of thinking. You are not logging in.

su does not create a login session. It is not a login mechanism. It "switches user" to run a program under the aegis of a different user account, adding privileges (that account's privileges) to the totality of privileges available to the user of the existing login session that it is run in.

The login database, reported by those various commands, lists login sessions. Adding privileges in an existing session does not change it, naturally.

(Some GUI terminal emulators, but not all, add login database entries for each emulated terminal that they provide. Yours is, but that is not su doing it. The entry is added long before you get around to running a su command in a shell using that terminal.)

Further reading

• Jonathan de Boyne Pollard (2014). Don't abuse su for dropping user privileges. Frequently Given Answers.
• Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
• https://unix.stackexchange.com/a/441817/5132
• https://unix.stackexchange.com/a/283543/5132

Answer 2

Have you previously killed any sessions of user test using kill -9?

Depending on operating system and the way it handles updates to the utmp/wtmp files, killing a user session with kill -9 may cause its session record in the utmp file to be left in a "session is active" state.

When a new session using the same (pseudo)TTY device is initialized, the code that writes the utmp entry sees that the slot for that TTY device is already used by an active entry, and uses the next free slot.

Then, commands like w, who or finger have a sensible expectation that only one user at a time can be using a TTY device, so once they find one entry for a particular TTY device, they won't look for any others... and so they display the wrong, stale entry instead of the one that is actually current.

The utmpdump command can be used to dump the binary utmp file into text format, for seeing if this kind of utmp corruption has happened. Then you can edit the text version to remove the stale entries, and use utmpdump -r to reconstruct a new binary utmp file with the corrupted entries removed.

Or, if you can have all the users log out for a moment, just have everyone else log out, truncate the utmp file to zero size, logout and log back in.

# echo "Everyone logout now, please" | wall
# > /var/run/utmp
# <logout>

And in the future, please use kill -HUP to end shell sessions instead of kill -9 or kill -KILL to avoid this problem in the first place.

Answer 3

You wrote

I further open two terminal sessions for each of the users respectively

And then in a comment you clarified that after opening a new terminal window

I then use "su - username" to log in to the other user

Opening the terminal window generates the entry in utmp. The su command does not. So every window you open will be registered to your original user account that's logged in.