bug#8643: 'who' command bug

[Bob Proulx]

Alan Curry wrote:
> Bob Proulx writes:
> > ding bat wrote:
> > > I was using Who to list all users connected to pptpd vpn server with
> > > maverick 10.10.
> > > I put natty on the computer and now the who command does not list out the
> > > vpn users. It only seems to list out local logged in user.
> > > any thoughts,.... this issue is killing me.....
> > > I can still do 'last |grep ppp' and get joy, but 'w' and 'who' were very
> > > nice.
> [...]
> > I am not an Ubuntu user and do not have a system to test with and so I
> > do not know what programs you would be running when you log in with
> > Ubuntu's Natty.  You will need to look at your system and determine
> > what login manager you are using.  This is probably gdm but might be
> > gdm3 but possibly one of several others.  You will need to determine
> > what terminal program you are using.  This is probably gnome-terminal
> > but possibly one of several others.  Both of those programs either
> > should (or should not) be logging user login information to utmp.
> 
> Bob apparently doesn't know what pptpd is. Or what "VPN" means. Or what PPP
> is. Or didn't read very carefully.

Or all of the above.  Or some of the above.  Not being a MS windows
user I have never used, nor needed to use, 'pptpd'.  I am very
familiar with VPNs on Unix and GNU systems and have set up and
maintain several.  I am using a VPN at this moment to answer this
message.

But I admit I didn't read that message carefully enough and missed the
comment that pptpd wasn't logging to utmp anymore.  I had assumed that
it was another report that terminals weren't logging users and that
was a wrong assumption.  Thanks for catching that item.

> But he's probably right anyway.

Figher pilots have an old say, "It is better to be lucky than good." :-)

> The bug is more likely to be in pppd than anywhere else. It's weird
> that it would write to wtmp (for last) but not utmp (for who). Check
> the config files for recent changes, and if you can't find the
> cause, find someplace that gives help with pppd.
>
> An strace of the pppd process during connection setup could be enlightening.

Agreed.

ding bat wrote:
> First, many thanks for such a great response. to be honest, I did not
> expect anyone to answer, or care about such a topic.

But of course!  It is a friendly development group.

> Anyway, I did some poking around and found out that pptpd (poptop vpn
> server) is likely logging users into the wtmp. I know that the users
> are specified in the Chaps-Secrets file and that they are logged in
> the wtmp upon login. I know that the 'last' command can show that wtmp
> file, and in my case, it does!!. I do 'last |grep ppp' and it shows
> the users and when they connected and disconnected to the vpn server.

I agree with Alan.  It is odd that it logs to wtmp but not utmp.

> The thing is, I thought the 'who' and the 'w' command also pull from
> the wtmp file, but I guess they dont??? perhaps they are pulling from
> the utmp file.
>
> if this is true, what is the difference between the utmp and the wtmp
> file.

The utmp file logs currently logged in users.  The file contains
records for each user.  If a user logs out then the entry is removed.

The wtmp file logs the history of who logged in and who logged out.
Instead of removing an entry it records that the user logged out.  All
things working okay then subtracting one from the other should yield
the same information as in the utmp file.  As long as a power failure
or system bug doesn't prevent accurate accounting then this will be
correct and in sync.  But not if a program logged a user in but then
crashes that user may not be recorded as having been logged out The
utmp database will still show the user logged in..  Later when the tty
is used again by another login from another user then that record in
the utmp file will be overwritten with the updated information and
corrected.  But until then it will be out of sync.

Looking at the man page for utmp will give you the details.

  man utmp

> And maybe you can speculate why pptpd/poptop is only logging in
> the wtmp to show in 'last' but not logging in utmp to NOT show in
> 'who' or 'w'. I could not find any settings to tweek and the only
> reference to any of the logs was in the file: "/etc/pptpd.conf" couple
> lines down where it specifies "logwtmp"

Not sure.  Verify that the utmp file is writable.  These files are
usually in different directories and may have different user and group
permissions.  On my system they are both root:utmp.

       /var/run/utmp
       /var/log/wtmp

If pptpd can't write to utmp but can write to wtmp then that would be
one explanation.

Bob