Subj : Serious utmp "who" issues
To   : comp.os.linux
From : Tim Underwood
Date : Wed Jun 23 2004 04:02 pm

I've run into a problem with Linux RH 7.2/7.3, and the issue of the utmp
file and who command.  The issue so far only relates to using the alternate
consoles (ALT-CTL-F1 - F6), and the use of telnet sessions (pseudo-ttys).
Here's what I'm seeing:

1.  Log in to alternate console 1 (tty1), and issue "who" command, and I
see:
      root     tty1     Jun 23 13:16

2.  Log in to alternate console 2 (tty2), and issue "who" command, and I
see:
      root     tty1     Jun 23 13:16
      root     tty2     Jun 23 13:16

3.  Log into first telnet session (pts/0), and issue "who" command, and I
see:
      root     tty1     Jun 23 13:16
      root     tty2     Jun 23 13:17
      user1   pts/0   Jun 23 13:18

So far, so good, HOWEVER:

4.  Log into next telnet session (pts/1), and issue "who" command, and I
see:
      root     pts/1   Jun 23 13:19
      root     tty2     Jun 23 13:17
      user1   pts/0   Jun 23 13:18

The utmp entry for tty1 is overwritten with the entry for pts/1.  If I log
into a third telnet session (pts/2), and issue "who" command, it will
overwrite the tty2 entry, and will appear as:
      root     pts/1   Jun 23 13:19
      root     pts/2   Jun 23 13:20
      user1   pts/0   Jun 23 13:18

Now, if the users on pts/1 and pts2 log out, you will only see:
      user1   pts/0   Jun 23 13:18

The same thing occurs if you login to the telnet sessions first, then login
to the alternate consoles, the alternate consoles overwrite the utmp entry
for pts/1 and pts/2.  Seems that the minor device number is what is being
used to match up, and determine whether to re-use a record or not.  This
happens for ALL alternate consoles and the corresponding pts/1 - pts/6
devices

This seems to be a SERIOUS bug.  I can't tell who's logged in, and who
isn't.  I also understood that the utmp file was to be a history of logins -
so why would /bin/login (I presume that's who's writing the entries) be
overwriting the utmp records anyway?

Is this a known issue?  Is there a fix?  I've got to find a solution to this
ASAP, since our company's application has quite a few places it uses "who"
to determine who/how many people are on the system.  Re-writing that code
isn't possible right now.

.