- In this video, I will tell you about session management.
So what is session management about?
Well, that is about managing and monitoring who's doing what
on your system.
To start with, there is who and w.
These are commands that have been around for a long time,
and which will show you the users
that are currently logged in.
Then there is loginctl.
Loginctl is relatively new,
and it's a part of the systemd solution.
I'll talk about systemd later.
Loginctl allows for current session management,
and you can do cool stuff like loginctl list-sessions,
and loginctl show-session
to show you properties of a session ID,
and loginctl show-user to get information about a user.
And the coolest of all is loginctl terminate-session,
which allows you to cut off a session.
Why would you wanna do that?
Well, once I have witnessed a system that was being hacked.
Being hacked, that means that I was using who
and I saw a user account that definitely shouldn't be there.
In cases like that, you are really going to love loginctl,
which allows you to cut off that session right now
and verify your security procedures.
Let me show you how to work with these.
All right, in order to show you how to do this,
I'm going to establish a remote connection.
So ssh linda@192.168.29.141.
Prompting for the password, there we go.
And linda has logged into the CentOS machine.
Now let's explore.
If I use who, then I can see the current users.
So I can see user student, and I can see user linda,
including the IP address that user linda is coming from.
Then when I use w, w is showing the same information,
but a little bit more detail.
So we can see LOGIN.
We can see IDLE.
Linda has been doing nothing for 17 seconds.
We can see some CPU usage,
and we can see what the user is doing.
I love w, because with w, you can monitor
if the user is actually doing something or not.
But that is not what I wanted to talk about.
I wanted to talk about loginctl.
So loginctl list-sessions is showing me what?
Well, basically the same information
with a session ID for every single session that exists.
And loginctl show-session
on session number 8
is giving more detailed information about the session.
Is this really useful information?
I'm not so sure about it, but at least we can see
that the user has come in through an ssh session,
the user is currently active, and some more properties.
Apart from monitoring the session,
you can also monitor the user.
So loginctl show-user
on user linda
is showing me the different properties for that user.
Now the user and session come pretty close to one another.
And what we see here, honestly,
is information that's not really that useful,
but by the time you know a lot about systemd,
this is showing useful information about this user.
Now as I told you, the coolest thing is loginctl ter tap.
If I use ter tap, I get tap completion,
which ends in a hyphen.
That probably means that there's too many choices.
So there we go, terminate-session is what I want.
I want to terminate session number 8.
And, oh yeah, I need to authenticate for that.
Now this is kind of cool.
Loginctl is using a system component that is called D-Bus.
D-Bus is for graphical applications
to communicate to one another.
And loginctl is communicating to GNOME,
the graphical session manager is telling GNOME, "Hey,
we need authentication."
This is the alternative to providing the sudo information,
and then, oh no, our connection timed out.
I was too slow.
So let's do it again.
And let me type the password.
And now the session is gone.
So loginctl list-sessions.
I don't have linda anymore.
And as you can see on the remote Ubuntu machine,
we have linda being sad.
No more user linda anymore.
I just terminated the session.