24

I am able to see logged-in users via the who or last command.

How can I log off a particular user who login through SSH?

Nathan J.B.
  • 2,640

2 Answers2

34

kill its ssh session. Check them by

ps aux | egrep "sshd: [a-zA-Z]+@"

Second column gives you the PID. Then,

sudo kill [-9] PID

Hope this helps.

ps: using the -9 flag will prevent things from stopping "graciously".

Community
  • 1
PEdroArthur
  • 586
  • 5
    Since the signal is being sent only to the sshd, the -9 will only prevent it from cleaning up properly, which may involve killing jobs the user was running in the ssh session, so should be avoided. – psusi Apr 20 '11 at 15:36
  • 1
    Are you sure? When a I talked about the -9 I was referring to the graciously stop of the SSHD terminal process. The running apps will be injured no matter the flag used. For example, try something like killing a user session when he is editing some file in Vim or Vi. No matter what flag, or even if any flag was used, the swap file will remain on FS and the user will be noticed about it whenever he tries to edit the file again. – PEdroArthur Apr 20 '11 at 17:20
  • @psusi BTW, I assumed that the OP was aware that is harmful to drop someones session, as some essential tasks may be interrupted or completely prevented from running. – PEdroArthur Apr 20 '11 at 17:23
  • you mean backup file, not swap file, and yes, no matter how you kill the process, files on disk are not affected, and most editors frequently write a backup file just in case. Anything typed since the last backup was saved will be lost if killed with -9, but not otherwise since the editor has a chance to save. Killing sshd with -9 is not a good idea since it prevents it from doing important cleanup tasks, like removing the login entry from wtmp so they disappear from w[ho]. – psusi Apr 20 '11 at 17:27
  • @psusi No, no, I mean swap files. This is how Vim and Vi call them. Nevertheless, in fault tolerance area, we call "gracious stop" or "gracious halt" when a system has the opportunity to execute all its cleanup routines, like the ones you enumerated for sshd. – PEdroArthur Apr 20 '11 at 17:34
1

I found this guys. Just replace USERNAME with the desired user session to be killed.

 kill [-9] $(ps aux | grep USERNAME@ | head  -n 1 | tr -s ' ' | cut -f 2 -d ' ')

As mentioned above, using the -9 flag will prevent things from stopping "graciously".

SuB
  • 4,229
  • 5
  • 24
  • 33
pvibes
  • 19
  • After kill -1 and at the end there must be the sign ` The comment system is not showing the quote signs. – pvibes Mar 07 '13 at 20:42
  • You might catch extra processes by grepping independently of the precise position. Also, ps ax does not show the username – false May 13 '14 at 12:55
  • In my humble opinion, grepping on USERNAME@ is too loose and it might appear legitimately in other programs CLIs. But besides, I recommend that you never pipe or apply ps | grep output to kill without inspecting it first. – PEdroArthur Feb 24 '21 at 02:15