who shows {unknown} user?

[meine]

hi,

I have a box with Fedora 17 Gnome3, latest updates and sveral accounts for my family members.
the system is behind two firewalled routers, ethernet cable connected, no wifi

tonight when I re-entered my account, my conky panel and '$ who' showed two known users and one named {unknown}.

is this a slip of some system part or what?

TIA, meine

[PabloTwo]

This seems to be the new "normal". There was an earlier thread on the forum with someone asking the same question and with the same "security" concerns. The unknown user is just some system thing that exists at bootup time. Use the "last" command to see how breifly unknown is logged in (virtually no time at all according to last).

BASH:~/-> last -15
paul     pts/0        :0.0             Wed Sep  5 20:21   still logged in   
paul     tty1         :0               Wed Sep  5 20:21   still logged in   
(unknown tty1         :0               Wed Sep  5 20:20 - 20:21  (00:00)    
reboot   system boot  3.4.9-2.fc16.x86 Wed Sep  5 20:20 - 21:11  (00:51)    
paul     pts/0        :0.0             Wed Sep  5 08:34 - 11:59  (03:24)    
paul     tty1         :0               Wed Sep  5 08:34 - 11:59  (03:25)    
(unknown tty1         :0               Wed Sep  5 08:33 - 08:34  (00:00)    
reboot   system boot  3.4.9-2.fc16.x86 Wed Sep  5 08:33 - 11:59  (03:25)    
paul     pts/0        :0.0             Tue Sep  4 22:02 - 23:00  (00:58)    
paul     tty1         :0               Tue Sep  4 22:02 - 23:00  (00:58)    
(unknown tty1         :0               Tue Sep  4 22:01 - 22:02  (00:00)    
reboot   system boot  3.4.9-2.fc16.x86 Tue Sep  4 22:01 - 23:00  (00:59)    
paul     pts/0        :0.0             Tue Sep  4 21:59 - 22:00  (00:01)    
paul     pts/0        :0.0             Tue Sep  4 20:07 - 21:58  (01:51)    
paul     tty1         :0               Tue Sep  4 19:37 - 22:00  (02:23)

I'm using F16

[nonamedotc]

Actually, I am not seeing that. Don't know what the difference is though .. Why?! F17 here ..

my_username tty1         :0               Wed Sep  5 20:22   still logged in   
reboot   system boot  2.6.32-279.5.1.e Wed Sep  5 20:21 - 21:16  (00:54)    
my_username tty1         :0               Tue Sep  4 22:22 - down   (09:46)    
reboot   system boot  2.6.32-279.5.1.e Tue Sep  4 22:21 - 08:08  (09:46)    
my_username tty1         :0               Mon Sep  3 23:14 - 05:38  (06:24)    
reboot   system boot  2.6.32-279.5.1.e Mon Sep  3 23:13 - 05:38  (06:24)    
my_username tty7         :0               Mon Sep  3 22:59 - 23:12  (00:13)    
my_username tty1         :0               Mon Sep  3 22:54 - 22:58  (00:04)    
reboot   system boot  2.6.32-279.5.1.e Mon Sep  3 22:53 - 23:12  (00:19)    
my_username tty1         :0               Mon Sep  3 22:22 - 22:52  (00:29)    

wtmp begins Sun Sep  2 13:17:30 2012

Could be some process specific "user"?

[DBelton]

That user is created (probably due to a bug) by GDM. It's not really that there is a "unknown" user logged into the system, but it's due to GDM writing a bad entry to /var/run/utmp

[jpollard]

Usually caused by very sloppy coding - the record was created (normal, because the user hasn't authenticated yet, so this part is normal), but if the login is aborted without an entry, the record should be cleared.

It is a fairly old bug as it also exists in F16.

BTW, for the curious this method of recording logins is very old - it records the timestamp when a login is started, not when it completes. Originally this enables auditing and detecting when someone is attempting attack a login by brute force... but when done poorly it leaves this around.

Usually the bug entries will be recorded at the same time as valid logins are recorded. The sloppy programming may be generating new records for a login when one has already been allocated.

[DBelton]

hey.. We are talking about Gnome!

How dare you to insinuate that there is very sloppy code created by the Gnome Gods! Their word is law, you know...

Seriously, I have seen way too much sloppy code in Gnome, and quite a few other applications lately. Things that would not have been tolerated just a couple of years ago, but now people are letting it by and saying how great it is.

[jpollard]

Oh, the coding has been getting sloppier...

gdm doesn't even alway open the display properly. It should start :0.0 after a boot, and should only be :0.0. Somewhere in the login switching it began creating a :1.0.

Now my logs show as high as a :42 (on tty8, where it should be tty7).

So it is quite sloppy. Anytime the login switching fails, it has shown a non :0.0 display. And once it starts failing it keeps failing.

[DBelton]

I saw something not long ago about systemd making changes to force the DM/DE to always use tty1 instead of whichever one happened to be the next available at the time.

It's getting to where it's hard to figure out where the errors are at times, though.

With systemd and Gnome 3 having a battle to see which can control more of the system, there are going to be some big issues soon.

[jpollard]

Always were big issues. They just got worse between systemd and everything else.

The "developer" never learned the best way to program: "Do one thing, and do it well", it seems to be self-aggrandizement where one person is trying to do everything, reflected in processes that are trying to do everything.

Usually ends up with a house of cards... when everything collapses into chaos and is useless.

Hopefully it won't take Fedora with it.