2

Sometimes when I shot down I get this message:

Other users are logged in.
 - root (console)

Now, it's my private computer and no one is allowed to connect to it.

Has my security been compromised? How can I prevent this?

Amots
  • 21
  • 2
    is it you who have logged into root? have you switched to a virtual-terminal and logged in, or opened a shell and su to became root; and your elevated session is what you're seeing as root? I just looked at my system and users show me and root; I hit the ctrl-alt-f4 & yep there is my 'root' – guiverc Dec 11 '17 at 12:07
  • 1
    Show the output of w. Yes, it's a one letter command. – M. Dm. Dec 11 '17 at 16:03
  • @guiverc I didn't log into root and haven't switched to a virtual-terminal. When I use su in a terminal session it does not appear as a separate user when I use users or w in another terminal window. @M.Dm. I guess you're asking for the output of w when I get the message on the question. I don't get it right now. – Amots Dec 12 '17 at 00:04
  • I'd suggest disabling remote 'root' login if it's enabled; forcing keyed entry only from remote (not passwords), and maybe watch your /var/log/auth.log file (note: cron and other jobs show in this file as well as users). tripwire and other apps can monitor your system for changes which may be worth considering too – guiverc Dec 12 '17 at 01:07
  • Thanks @guiverc for your reply. How do I disable remote root login? – Amots Dec 12 '17 at 09:58
  • have a look at https://askubuntu.com/questions/27559/how-do-i-disable-remote-ssh-login-as-root-from-a-server – guiverc Dec 12 '17 at 10:33
  • Open a Terminal and type: 'w'. Is an entry shown for the 'root' account? – Justin Andrusk Jan 24 '18 at 19:58

0 Answers0