1

I know I can see the list of logged in users with w or similar commands. I want to know which of logged in users currently has root access, i.e. has done su to become root. The output of w just shows the first (actual) username, not root if the user has done su.

1
  • What are you asking? You said it yourself that output of w just shows the first (actual) username, not root if the user has done su.. And you are asking how to detect which user is root? This is already what w shows you.
    – ek9
    May 1, 2014 at 7:46

3 Answers 3

3

Indeed w only displays login shells. If a user does su to another program (shell) it will not display because it is not a login shell.

The main problem here is that you are trying to correlate date which was not designed to be correlated. You have to get information from several sources and then cross-reference it.

To get a list of all people who used su, you can check /var/log/auth (depending on your distro). You will see the following message:

May  1 09:47:32 frisbee su[7000]: Successful su for root by mtak
May  1 09:47:32 frisbee su[7000]: + /dev/pts/5 mtak:root

You can check which pts'es are still active by checking if the pseudo-terminals are still active with ls /dev/pts (you would have to do this quickly though, because pts'es get re-used). You could also use the modify time of the pseudo-terminal and cross-reference it with the time in the auth.log file. You can find the modify time of the pts with stat /dev/pts/.

Admittedly, it's not perfect, but I think with some scripting you would be able to get a list of users who su'ed.

2
  • 1
    Alternatively, since OP is also asking about who "has" root access - which is not necessarily synonymous with having used su - another solution would be to cross-check the output of w with those users in groups with root access.
    – Pockets
    May 1, 2014 at 9:02
  • The OP also says "has done su to become root", which means he wants to who actually became root, but I have to agree that it's debatable. Maybe we should start using formal languages in everyday speech :)
    – mtak
    May 1, 2014 at 9:11
1

You can use ps to check which user is running a su process.

ps aux | grep ' [s]u'
1

This should give you a list of user names who are running 'su -' to be root:

for ppid in $(for pid in $(pgrep -u root -f "^su -"); do ps lh $pid | awk '{print $4;}'; done); do ps uh $ppid | awk '{print $1;}'; done | uniq

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .