Ask Your Question

Dubious Logged in Users

asked 2014-05-10 13:16:49 -0500

Liu Yuting gravatar image


On my Fedora, when I'm the only logged in user and typed "who" or "top" under command line, it showed that there are currently two logged in users, both with my account identification.

Is it because the Fedora has been breached or cracked so that intruders have gained access to it?

If so, may I ask how to identify the problem and fix it?


edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2014-05-11 14:03:00 -0500

yanglifu90 gravatar image

updated 2014-05-11 14:04:35 -0500

No it's just you opened two devices

If given no non-option arguments, 'who' prints the following information for each user currently logged on: login name, terminal line, login time, and remote hostname or X display.

I don't know the devices you use, but in my case, I get a :0 and pts/0, which stand for X display and a pseudo terminal respectively.

tengo :0 2014-05-11 20:01 (:0)
tengo pts/0 2014-05-12 01:51 (:0)

The first one is the time the system starts, the second has the time the terminal program(pseudo terminal slave) starts.

Tpye info coreutils 'who invocation' in the terminal to see more info on who , and see and

edit flag offensive delete link more


The fedora is under text mode. Please refer to comments under sideburns' replies.

Liu Yuting gravatar imageLiu Yuting ( 2014-05-11 16:38:59 -0500 )edit

answered 2014-05-10 15:07:23 -0500

sideburns gravatar image

Nobody has hacked you and there's no problem to be fixed, except for your understanding of the situation. There are, at that time, two people logged into your machine, but both of them are you. That is, you are logged into your regular GUI account, and you're logged in at the CLI you're using, so there are two active logins. To check this, open several CLI interfaces and you'll see that the number increases to match.

edit flag offensive delete link more


However, the Fedora is under text mode. There should be no logged-in GUI account.

Liu Yuting gravatar imageLiu Yuting ( 2014-05-10 16:34:24 -0500 )edit

There was nothing in your original question to indicate this. Are you sure you're only logged in once?

sideburns gravatar imagesideburns ( 2014-05-10 19:17:14 -0500 )edit

The other could be a zombie previous login, but I'm not sure whether Fedora is that prone to such issues. May I ask whether it's possible to tell the difference between a zombie previous login from an intruder?

Liu Yuting gravatar imageLiu Yuting ( 2014-05-11 16:35:33 -0500 )edit

Thanks for the reply, by the way.

Liu Yuting gravatar imageLiu Yuting ( 2014-05-11 16:35:51 -0500 )edit

Question Tools

1 follower


Asked: 2014-05-10 13:16:49 -0500

Seen: 384 times

Last updated: May 11 '14