'w' Shows 2 users lists one

[Derek Broughton]

John Hubbard wrote:

> Derek Broughton wrote:
>> John Hubbard wrote:
>>   
>>> jhubbard at jhubbard-server:~$ w
>>>  10:54:48 up 32 days,  2:45,  2 users,  load average: 0.32, 0.27, 0.16
>>> USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
>>> jhubbard :0       -                Mon21   ?xdm?  14:52   0.10s /bin/sh
>>> /etc/xdg/xfce4/xinitrc -- /etc/X11/xinit/xserverrc
>>>
>>> Why does the w command list that I have two users currently logged in
>>> but only show one.  I realize that there are actually many more than 2
>>> users logged in (all users with a uid <1000) but either all or none of
>>> them should be shown.
>>
>> Beats me - my system tells me 2, also, but there really are - I have this
>> session on ":0" and a console login on tty1, and w shows both.
>>   
> It does scale properly. If I add an ssh login or a tty# login it still
> shows expected logins +1. Is it possible that I have been hacked? I have
> a few ports open to the internet. I have trimmed this back to only
> include 22 (SSH) but for a while ports 20~23 (ftp, ssh, telnet), 8080
> (apache2), and 6881 (ktorrent) were open. I plan to reboot in a little
> while but I am always sad to see the uptime drop back down to 0.

I don't really know, because I'd never heard of 'w' until you asked, but
what does "ps a" show you?  You should see tty1-tty6, which are running
either /sbin/getty, meaning they're waiting for a login, or some program
(usually /bin/login) indicating a logged-in user.  If it's
running /bin/login, it will also have at the least a process running a
login shell.  Then you'll have tty7 - and possibly 8-12 - running X (as
root), on which your desktop users are logged in.  The "pts" sessions
shouldn't matter unless they're SSH session - they're terminals inside your
destkop.  'w' will show the ssh sessions as "from" somewhere else, anyway.
-- 
derek