2

It's much from curiosity and from a recent system crash :-| but I'd like to confirm something.

Linux came from minix which was based on unix systems, and unix by their task were designed to be multiuser systems. So, I wondered and remember using somewhere, that a computer (like ours, simple laptop or PC) can be controlled remotely without the user even knowing that someone else is using their computer, i.e. via terminal or some other means.

In such a situation, how can one confirm, that he is the only one using his PC?

lind
  • 23
  • 1
    If someone else has enough access to create accounts, install and enable ssh, etc., they probably also have enough access to hide their activity. – muru Mar 07 '18 at 10:32

1 Answers1

3

First of all Linux did not come from Minix, and Minix is not based on Unix. Minix is a Unix-like operating system. So is Linux. They have independent code bases.

You can check who's logged in with w in a terminal:

$ w
 11:15:32 up 3 days, 14:07,  4 users,  load average: 0.40, 0.64, 0.75
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
vidarlo  pts/0    :0               Sat21   49:08   4.45s  4.40s alpine
vidarlo  pts/1    :0               Sat21    0.00s  0.10s  0.00s w
vidarlo  pts/2    :0               Sat21    1:17m 54.29s 54.25s mosh-client eli
vidarlo  pts/3    :0               Sat21   26:52   0.26s  0.03s ssh nina

Note that my own account shows up multiple times, but all are from :0, which is the first X server.

If I run this on a box with more users logged in, it will produce a different output:

[~]$ w
 11:16:32 up 17 days,  1:58, 12 users,  load average: 0.24, 0.27, 0.27
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
a        pts/1    95:S.0           18Feb18  1:18m  2:39   2:39  irssi -c freeno
b        pts/2    80:S.0           18Feb18  1:12   2:13   2:13  irssi
a        pts/4    95:S.3           Sun20    2days  0.03s  0.03s /bin/bash
a        pts/5    95:S.2           18Feb18  2days  0.03s  0.01s /bin/bash
c        pts/0    217:S.0          28Feb18 22:36m 47.15s 47.12s irssi
d        pts/6    62.101.nnn.nn    Mon15   43:28m  0.07s  0.07s -bash
e        pts/7    193.157.nnn.nn-  09:03    1:12   0.43s  0.39s screen -r
c        pts/8    217.140.nn.nnn-  Tue17   22:36m  1.01s  0.95s screen
a        pts/9    95.34.nnn.nn-    07:57    0.00s  0.54s  0.51s screen -x
a        pts/11   95:S.4           Mon19   39:24m  0.00s  0.00s /bin/bash
a        pts/3    95:S.1           Sat22    3days  0.13s  0.00s /bin/bash
a        pts/12   95:S.5           11:16    0.00s  0.00s  0.00s w

I've redacted the usernames and IP's to conserve some privacy, but the IP-addresses indicates they're logged on remotely.

Note that malware and backdoors will not necessarily show up in w, as they may attempt to hide. In general, Ubuntu has a fairly sane setup, with no insecure services listening for remote connections. If you in addition keep your system up to date, and use good passwords, only users you give access will have access.

But multiple users may indeed use the same computer, without noticing each other to any degree.

vidarlo
  • 22,691