Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I identify all terminals that have a root login on them on Linux?

who -a seems to give me regular logins but what about root?

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

The who command (and the w command for that matter) also shows root logins, but if someone logged in as a normal user and eleveted his/her rights with su/sudo than it won't show it since the login hasn't really changed.

So in that case you are probably better off looking for su, sudo or /bin/bash (or whatever the shell) processes.

I would guess that something like this should work for you:

ps aux | grep -E '/bin/zsh|/bin/bash'

Although you probably want to look at /etc/shells instead of hardcoding the shells.

share|improve this answer
1  
Additionally, have a look through /var/log/secure, which should identify su's to root and others. –  anastrophe Aug 30 '11 at 18:39
add comment

Use w to see who is logged on:

w | grep root
share|improve this answer
    
who (with no additional options) should also list terminals where root is logged in... –  voretaq7 Aug 30 '11 at 16:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.