Thanks Nate,
Yes w gave me the station name connecting to it. However, w didn't show
the user logged into :0. I had 5 users showing and the first line of w
stated there were 6 users currently connected. Who gave me all six but the
machine remotely connecting in did not show. Between the two I get a better
view of what is going on. All of this stemmed from an e-mail from
[EMAIL PROTECTED] stating that they were receiving spam from my
network and I'm the only user back here. I started scrutinizing everything
I could find and have not found any evidence of tampering other than that
unidentified :0 (till now). I only have my internal network set up under
relay-domains and I checked sendmail.cf to make sure someone hadn't changed
the name and location of the relay file. I think I am going to set up
accounting and set up a log server just to be sure. I think though, that
the spam message was spam in and of itself.
Larry
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Behalf Of nate
Sent: Tuesday, March 18, 2003 3:29 PM
To: [EMAIL PROTECTED]
Subject: Re: who results?
Larry Brown said:
> I have two questions about who results if anyone can help... One of the
> user's shown is on line ":0", is this normal? And nothing is listing in
> the FROM column including my current connection via ssh. How can I find
> out the ip source of the connected users?
that's normal. it means the user is logged in via X11 display #0. Nothing
is in the from column because the user is on the local console.
as for listing the IP, that is odd how it does not do it for your SSH
connection.. do any of the other commands show the IP? I use 'w'
normally but 'finger' should show the info as well.
nate
--
redhat-list mailing list
unsubscribe mailto:[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
--
redhat-list mailing list
unsubscribe mailto:[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
