Who is logged into my server?

Question

Yesterday I ran the w command. Normally, the output looks like this:

USER     TTY      FROM                  LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    p4...2f50.dip0.t..... 21:01    4.00s  0.05s  0.00s w

It is a private test server I use for testing some of my projects. The only person using it am I, so I should also be the only person logged into it. However, it displayed the following:

USER     TTY      FROM             LOGIN@          IDLE   JCPU   PCPU WHAT
root     pts/0    p4...2f50.dip0.t 21:01           4.00s  0.05s  0.00s w
root     ...      p4...2f50.S:0    (8 days ago)    ...    ...    ...   /bin/bash

I added the "..." because I cannot remember the values and forgot to take a screenshot unfortunately.

What's important is, is that there seems to be a second person logged in for a long time. I also noticed the the value at "FROM" is very similar. It begins with the exactly same sequence of numbers and letters and ends with .S:0 or :S.0 (I also can't remember that).

Now, I do not know very much about the meaning of these values. Is there really somebody else logged in? Or is it maybe a "bugged" SSH-Session which was not closed correctly by myself?

Answer 1

TTYs ending in :S.0 are usually created by screen. Most likely: no one is logged in on that shell, you've just forgotten about it, connection closed, shell's still alive.

To track how your process was created, you can look at ps fauxww | less, type /ttyname to search your tty name, you should find its parent process (probably a bash or sshd), and its child processes:

root     10307  0.2  0.0 107732  4260 ?        Ss   03:59   0:00  \_ sshd: root@pts/0    
root     10326  1.0  0.0  23240  4372 pts/0    Ss   03:59   0:00      \_ bash
root     10361  0.0  0.0  18600  1408 pts/0    R+   03:59   0:00          \_ ps fauxww
root     10362  0.0  0.0   9544   928 pts/0    S+   03:59   0:00          \_ less

or with a screen:

root     10326  0.1  0.0  23240  4416 pts/0    Ss   03:59   0:00      \_ bash
root     12524  0.0  0.0  26920  1116 pts/0    S+   04:00   0:00          \_ screen
root     12525  0.0  0.0  27052  1396 ?        Ss   04:00   0:00              \_ SCREEN
root     12526  0.3  0.0  23280  4464 pts/1    Ss   04:00   0:00                  \_ /bin/bash