14

Is there a simple way for me to force another user off of a linux box, while I am logged in as root? I understand that I could determine what type of session they have open, and kill the pid - but I'm thinking there must be a command to do this that I don't know about.

Any ideas?

4 Answers 4

16

You can simply slay(1) him. :-)

6
  • Ha! Neat. I'd never heard of this command before. Is it available on all systems? Sure looks like it beats killing their shell process. Commented May 5, 2009 at 19:27
  • It's probably packaged for all distros, but if you need something that works everywhere, skill from procps---as Mihai points out---might be a better choice. It has less style though ;-) Commented May 6, 2009 at 7:31
  • 1
    openSuse 11.4 - slay: command not found :( :( Commented May 25, 2012 at 20:39
  • Not installed on the Ubuntu 12.04 or RHEL 3 hosts that I have currently available, I do have the skill command detailed by Mihai Limbăşan. YMMV
    – David
    Commented Feb 27, 2013 at 9:16
  • Install it from universe: packages.ubuntu.com/search?keywords=slay Commented Feb 28, 2013 at 11:11
10

You can kill all of an user's processes via skill. Example:

  • skill -TERM -u username

will send SIGTERM to all of username's processes. To kill them for good (via SIGKILL) use -KILL instead of -TERM - please note, though, that you will most likely cause them to lose data that way. It's highly effective, mind you...

skill is part of the procps package which is installed by all distributions by default.

1
  • For others that want to do this for all remote user session, the -v flag (-v pts/*), which is from the man page might be useful.
    – David
    Commented Feb 27, 2013 at 9:14
3

The pkill and killall are preferred over skill. This is from the skill man page:

These tools are probably obsolete and unportable. The command syntax is poorly defined. Consider using the killall, pkill, and pgrep commands instead.

This should do the trick:

sudo pkill -KILL -u [user]

or

sudo killall -u [user]
1
0

Another easy way to do it is to run kill -1 <pid> where pid is the process ID number of the SSH session.

By running this command, you can see all the sshd process trees, by killing the parent process ID you will effectively kill the user session associated with it:

$ ptree -p

Look for sshd and then run:

$ kill -1 39383

Where 39383 is an example of an arbitrary process ID number.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .