Check who is logged in on another machine without ssh?

Question

Is there a way to find out who is logged in to another Linux machine on the network given the machine name and not just sshing into that machine and running who? I'd prefer a way directly in python, but through a command would be fine.

Answer 1

There are lots of ways of doing this (most of them insecure). Perhaps you aren't familiar with the fact that ssh can take an optional command (it logs in, runs the commands and logs out):

ssh user@host who

And if you set up a key you can do this with no password prompt.

Answer 2

If the Linux machine has the finger daemon installed, you may be able to:

finger @linux_machine

However, finger is usually considered insecure these days and is not generally available by default.

Answer 3

You could set up a service that does this for you on the remote machine and simply return the result; or you write a script that does the whole procedure for you. But I don't see why anyone outside (outside of the machine) should be able to access system information without logging in (and as soon as you log in you can use SSH instead).

Answer 4

It depends, things need to be set up to allow you to do this. One possibility is 'rusers'

http://www.oreillynet.com/linux/cmd/cmd.csp?path=r/rusers

Answer 5

If your preference is to do your ssh op's programatically via python then you should look at paramiko, a native python ssh library.

There's a good over view article here

Rob

Answer 6

I wonder how you could discover such a thing without connecting to the machine..

You could host a small daemon on host machine which sends packets to a specified destination over time to warn about connections to itself.. but a ssh remote command would be the easiest way..

Answer 7

Short answer: Not unless the machine is specifically set up for it.

Long answer: The machine would need to be running a service on a known port that you could connect to to query this information. An alternative is to use pexpect to programmatically ssh into the machine, run who and parse the results.

Answer 8

A tricky way would be to find a way to derive the information from a directory service. Many, many people have Enterprise systems with their authorized user list/password management coming from ActiveDirectory. If you could find a way to pair your question with the Kerberos Ticket Granting Ticket service, along with short-lived tickets, it just might be possible to at least infer who is probably logged in. If the system tells the directory service when a user logs out, things are a little easier.

You probably wanted the answer "finger" though and just didn't know it. Where finger went wrong though was when it started letting users create a $HOME/.finger because all kinds of problems erupted from that (named pipes and so on). Additionally, the finger protocol had some serious flaws that allowed for the usual buffer overflows, etc. Some paranoid folks consider that even listing the user IDs or user names of valid users provides an attack vector. If you could scan the network looking for the system a lead researcher used, that's a machine with access to lots of material ripe for industrial espionage.

Another interesting trick would be to have the system notify a central service whenever a user connected or disconnected. Think an IRC bot, chat server, or a REST service. Any process could periodically look for interactive sessions and submit the information in a one-way kind of fashion to an application on the other end. This application would then collate the feed to present a list of who is on "the network" to a web page. If this is for interesting business or education programs, it could be quite interesting because you could even log in users coming in through a web application like webmail.

Answer 9

Only the target machine knows who's logget into it.

If you cannot use SSH you'll need some other service, you can either have a server to ask to, or could have the target machine informing you via broadcast messages or something like that.

Answer 10

You could write a daemon on the servers you want to monitor that periodically connects to a central server and sends this information to it. Perhaps via a connection to a central database over TCP then just have the daemon run "who" and upload the data via some SQL.