I (logged in as "user1", has root access) was following this to experiment with kicking a client ssh session logged in as "user2" (has no root access), connected from the same network from a laptop. The results of the who -u command showed both "user1" and "user2"

 15:15:59 up  2:03,  2 users,  load average: 0.00, 0.03, 0.09
user1     :0           2020-03-28 13:59   ?          4232 (:0)
user2   pts/1        2020-03-28 14:40   .         13155 (

I then did

sudo kill -9 13155

to assumingly kill their ssh session.

But not only did it not work (the terminal connected using ssh from my laptop as user 2 still has an active SSH session and is able to run commands), the new results of who don't show that running ssh session anymore!!!!

user1     :0           2020-03-28 13:59   ?          4232 (:0)

Am I misunderstanding how who and kill commands work? who should list all logged in/active users. But clearly it doesn't as user2 is logged in but not listed by who.

I am willing to run any (well.. not literally ANY ;) ) commands and share the output with you to help me figure this out.

  • The who command just displays the content of the /var/run/utmp file. No more no less. See my comments here, here and here. Check if that ssh process is still running with pgrep -a <pid> or ps <pid>.
    – user313992
    Commented Mar 29, 2020 at 0:06
  • only ps <pid>, sorry
    – user313992
    Commented Mar 29, 2020 at 0:19


You must log in to answer this question.

Browse other questions tagged .