24

I am able to see logged-in users via the who or last command.

How can I log off a particular user who login through SSH?

0

2 Answers 2

34

kill its ssh session. Check them by

ps aux | egrep "sshd: [a-zA-Z]+@"

Second column gives you the PID. Then,

sudo kill [-9] PID

Hope this helps.

ps: using the -9 flag will prevent things from stopping "graciously".

5
  • 5
    Since the signal is being sent only to the sshd, the -9 will only prevent it from cleaning up properly, which may involve killing jobs the user was running in the ssh session, so should be avoided.
    – psusi
    Commented Apr 20, 2011 at 15:36
  • 1
    Are you sure? When a I talked about the -9 I was referring to the graciously stop of the SSHD terminal process. The running apps will be injured no matter the flag used. For example, try something like killing a user session when he is editing some file in Vim or Vi. No matter what flag, or even if any flag was used, the swap file will remain on FS and the user will be noticed about it whenever he tries to edit the file again. Commented Apr 20, 2011 at 17:20
  • @psusi BTW, I assumed that the OP was aware that is harmful to drop someones session, as some essential tasks may be interrupted or completely prevented from running. Commented Apr 20, 2011 at 17:23
  • you mean backup file, not swap file, and yes, no matter how you kill the process, files on disk are not affected, and most editors frequently write a backup file just in case. Anything typed since the last backup was saved will be lost if killed with -9, but not otherwise since the editor has a chance to save. Killing sshd with -9 is not a good idea since it prevents it from doing important cleanup tasks, like removing the login entry from wtmp so they disappear from w[ho].
    – psusi
    Commented Apr 20, 2011 at 17:27
  • @psusi No, no, I mean swap files. This is how Vim and Vi call them. Nevertheless, in fault tolerance area, we call "gracious stop" or "gracious halt" when a system has the opportunity to execute all its cleanup routines, like the ones you enumerated for sshd. Commented Apr 20, 2011 at 17:34
1

I found this guys. Just replace USERNAME with the desired user session to be killed.

 kill [-9] $(ps aux | grep USERNAME@ | head  -n 1 | tr -s ' ' | cut -f 2 -d ' ')

As mentioned above, using the -9 flag will prevent things from stopping "graciously".

3
  • After kill -1 and at the end there must be the sign ` The comment system is not showing the quote signs.
    – pvibes
    Commented Mar 7, 2013 at 20:42
  • You might catch extra processes by grepping independently of the precise position. Also, ps ax does not show the username
    – false
    Commented May 13, 2014 at 12:55
  • In my humble opinion, grepping on USERNAME@ is too loose and it might appear legitimately in other programs CLIs. But besides, I recommend that you never pipe or apply ps | grep output to kill without inspecting it first. Commented Feb 24, 2021 at 2:15