How can I identify all terminals that have a root login on them on Linux?
who -a
seems to give me regular logins but what about root?
The who
command (and the w
command for that matter) also shows root logins, but if someone logged in as a normal user and eleveted his/her rights with su
/sudo
than it won't show it since the login hasn't really changed.
So in that case you are probably better off looking for su
, sudo
or /bin/bash
(or whatever the shell) processes.
I would guess that something like this should work for you:
ps aux | grep -E '/bin/zsh|/bin/bash'
Although you probably want to look at /etc/shells
instead of hardcoding the shells.
Use w
to see who is logged on:
w | grep root
who
(with no additional options) should also list terminals where root is logged in...