Re: Xwindow "ghost"?

From: Geoff (greendog_at_nospampacific.net.au)
Date: 03/18/05 

Date: Fri, 18 Mar 2005 14:35:49 +1100

Larry I Smith wrote:

>
> It seems to be KDM causing the IP entry.
> I traced it backwards.
>
> First, run "last" to find the unexpected IP address that
> is logged on. Here's a snip of the output from "last -di":
>
> user1 :0 220.170.236.183 Thu Mar 17 13:24 still logged in
>
> Second, run "who" to get the PID associated with the session
> at user1:0. Here's a snip of the output from "who -H -a":
>
> NAME LINE TIME IDLE PID COMMENT
> user1 ? :0 Mar 17 13:24 ? 6604 (console)
>
> Third, run "ps" to get the process-tree. Here's a
> snip of the process-tree from "ps -ejH":
>
> PID PGID SID TTY TIME CMD
> 1 0 0 ? 00:00:03 init
> <snip>
> 6588 6573 4534 ? 00:00:00 kdm
> 6602 6602 4534 ? 00:01:06 X
> 6604 6573 4534 ? 00:00:00 kdm
> 7383 7383 4534 ? 00:00:00 kde
> 7418 7383 4534 ? 00:00:00 gpg-agent
> 7419 7419 7419 ? 00:00:00 ssh-agent
>
> So, the 2nd instance of KDM holds the session belonging
> to 220.170.236.183.
>
> My conclusions are:
>
> Either KDM is putting bad data into /var/log/wtmp -or-
> 'last' is interpreting the wtmp data incorrectly -or-
> KDM is do somehing very non-standard.
>
> Regards,
> Larry
>

Looks like your right, I managed to dig these up:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=82540
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=98659
http://bugs.mandrakelinux.com/query.php?bug=532

It's happening on Debian sid here. My mystery ip is 112.63.253.183
$ whois 112.63.253.183
Unknown AS number or IP network. Please upgrade this program.

Geoff

Relevant Pages

  • Re: SuSE 9.3 - Three Minor Glitches
    ... Larry I Smith wrote: ... > 2) All attempts to get kdm to display a selectable ... > list of users on the initial logon panel fail. ... When it spins down, SuSE spins it ...
    (alt.os.linux.suse)
  • Re: SuSE 9.3 - Three Minor Glitches
    ... > Larry I Smith wrote: ... >> 2) All attempts to get kdm to display a selectable ... SuSEconfig will display an error stating that 'kdmrc' ... there is a disconnect between the KDE Control Center ...
    (alt.os.linux.suse)
  • Re: Xwindow "ghost"?
    ... Larry I Smith wrote: ... > It seems to be KDM causing the IP entry. ... > I traced it backwards. ...
    (alt.os.linux.suse)
  • Re: SuSE 9.3 - Three Minor Glitches
    ... Larry I Smith wrote: ... > 2) All attempts to get kdm to display a selectable ... > list of users on the initial logon panel fail. ... When it spins down, SuSE spins it ...
    (alt.os.linux.suse)
  • Re: SuSE 9.3 - Three Minor Glitches (First)
    ... Larry I Smith wrote: ... DISPLAYMANAGER variable is set to "kdm", but YaST always set DM to ... It can happen because some script doesn't read DISPLAYMANAGER ... from /etc/sysconfig/displaymanager, or has hardcoded "gdm", or some ...
    (alt.os.linux.suse)