Kill illegal user

The commands involved are as follows:
WHO/W/PS/kill/pkill/killall
View the current logon User:
[[Email protected] ~] # Who
Root pts/1 2010-08-09 08:05 (192.168.1.191)
Kaifa pts/2 2010-08-09 (192.168.1.191)
[[Email protected] ~] #
The first column is the user name,
The second column is the connected terminal, tty indicates the display, PTS indicates remote connection,
The third column is the logon time,
View logon user behavior:
[[Email protected] ~] # W
09:11:36 up 81 days, 2 users, load average: 0.30, 0.40, 0.20
User tty from [email protected] idle jcpu pcpu what
Root pts/1 192.168.1.191 08:05 0.00 s 0.07 s 0.00 S W
Kaifa pts/2 192.168.1.191 09: 07 3.00 s 0.03 s 0.02 s Vim kaifa. Sh
[[Email protected] ~] #
Users indicates that the total number of login users in the current system is 2.
Together with the subsequent numbers, the load average indicates the system load in the past 1, 5, and 10 minutes. The smaller the value, the lighter the system load.
A table is formed from the second row. There are 8 columns that show what each user is doing and the system information occupied by the user.
User: displays the login user account name. The user logs in again, and the account will appear again.
TTY: the terminal used for user login.
From: displays where the user logs on to the system.
[Email protected]: indicates the time when login at logs into the system.
Idle: the user's idle time, starting from the end of the last task.
Jcpu: indicates the CPU time consumed by all process tasks related to the terminal within a certain period of time.
Pcpu: the CPU time consumed by tasks in what domains after execution.
What: indicates the current task.
When many users log on to the system, you can add a user name after W to view the task execution status of the user.
View the task execution status of the kaifa user
[[Email protected] ~] # W kaifa
09:12:26 up 31 days, 2 users, load average: 0.00, 0.00, 0.00
User tty from [email protected] idle jcpu pcpu what
Kaifa pts/2 192.168.1.191 09: 07 53.00 s 0.03 s 0.02 s Vim kaifa. Sh
[[Email protected] ~] #
View logon user history
[[Email protected] ~] # Last
Kaifa pts/2 192.168.1.191 Mon Aug 9 09:07 still logged in
Root pts/1 192.168.1.191 Mon Aug 9 08:05 still logged in
Root pts/1 192.168.1.191 sun Aug 8)
Root pts/1 192.168.1.191 sun Aug 8)
Root pts/3 192.168.1.191 Fri Aug 6)
Root pts/2 192.168.1.191 Fri Aug 6)
Root pts/1 192.168.1.191 Fri Aug 6)
Root pts/2 192.168.1.191 Thu Aug 5)
Root pts/1 192.168.1.191 Thu Aug 5)
Root pts/2 192.168.1.191 Wed Aug 4)
Root pts/2 192.168.1.191 Wed Aug 4)
Root pts/5 192.168.1.191 Wed Aug 4)
Root pts/4 192.168.1.191 Wed Aug 4)
Root pts/3 192.168.1.191 Wed Aug 4)
Root pts/2 192.168.1.191 Wed Aug 4)
Root pts/1 192.168.1.191 Wed Aug 4)
Root pts/1 192.168.1.191 Tue Aug 3)
Root pts/1 192.168.1.191 Tue Aug 3)
Root pts/2 202.130.136.158 Mon Aug 2)
Root pts/2 192.168.1.191 Mon Aug 2)
Root pts/2 192.168.1.191 Mon Aug 2)
Root pts/1 192.168.1.191 Mon Aug 2)
Root pts/1 192.168.1.191 sat Jul 31)
Root pts/2 192.168.1.191 Fri Jul 30)
Root pts/1 192.168.1.191 Fri Jul 30)
Root pts/6 192.168.1.191 Thu Jul 29)
Root pts/6 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/5 192.168.1.191 Thu Jul 29)
Root pts/1 192.168.1.191 Mon Jul 26)
Root pts/3 192.168.1.191 Sun Jul 25)
Wtmp begins Wed May 12 18:38:10 2010
View SC User Logon history
[[Email protected] ~] # Last kaifa
Kaifa pts/2 192.168.1.191 Mon Aug 9 09:07 still logged in
Kaifa pts/4 192.168.1.191 Thu Jul 29)
Kaifa pts/5 192.168.1.191 Fri Jul 23)
Kaifa pts/4 192.168.1.191 Fri Jul 23)
Kaifa pts/1 192.168.1.191 Wed Jul 21)
Kaifa pts/4 192.168.1.191 Wed Jul 21)
Kaifa pts/1 192.168.1.191 Tue Jul 20)
Wtmp begins Wed May 12 18:38:10 2010
[[Email protected] ~] #
I want to kick the kaifa user and all his enabled programs.
[[Email protected] ~] # Pkill-u kaifa
Note: This command is actually very dangerous and should be executed with caution, because all operations of this user will be immediately ended and not saved.
To ensure security, first check the terminal number, view all processes executed by the terminal, and stop the service according to the process number.
Remove users safely
[[Email protected] ~] # Ps-Ef | grep pts/2
Obtain the PID of the logon process and run it.
[[Email protected] ~] # Kill-9 PID