$ users

# Non-login shell, /root/.profile not sourced.
$ su
$ users

# Login shell, /root/.profile sourced.
$ su -
$ users

So we launch a login shell as another user in the last example, but still only the original user is 'logged in'. How is the concept of 'logged in user' defined?

  • 2
    The login binary (or equivalent) was never executed when you started those other shells. Hence you never logged in again. – Kusalananda Jan 13 at 11:27

Unix/Linux systems maintain a database of currently logged-in users, in the /var/run/utmp file (in some Unix variants there's also a parallel utmpx file, but they both serve the same purpose). The login program, which controls login on a physical console, the ssh daemon or GUI login programs for machines with X servers update information in that file when user logs in or out. who command reads information from that database.

The shell you start with su - is a "login" shell in sense that it behaves in the same way as the login shell started by the login program or ssh daemon (executes the same initialization files, etc.) but it does not record logins in utmp file, therefore you don't see these shells in the output of who command.

On the other hand, if you eg. start a screen session, screen records an entry in the utmp file and you can see the session in the output of who command.

Also, in some graphical DEs each new terminal window that you open is considered a new login and recorded in utmp, and in another ones not - there is only one main entry in utmp for the user being logged to the whole DE session. It depends on the terminal application of course.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.