How to View Logged-in Users in Debian 12 Bookworm System

Monitoring logged-in users on your Debian 12 Bookworm system is an essential task for system administrators and power users. It helps you track system usage, detect unauthorized access, and troubleshoot issues. In this guide, we will explore different methods to view logged-in users on Debian 12 using various command-line tools.

1. Understanding User Sessions in Debian 12

In Linux-based systems like Debian, multiple users can log in simultaneously. User sessions can be local (console-based), remote (via SSH), or graphical (GUI sessions). Linux provides several built-in commands to monitor these sessions.

2. Using the who Command

The who command is one of the simplest ways to check logged-in users.

Syntax

who

Example Output

user1    tty1         2024-03-30 10:15 (:0)
user2    pts/0        2024-03-30 10:20 (192.168.1.100)

Explanation

• user1 is logged in locally on tty1.
• user2 is logged in remotely via SSH from 192.168.1.100.
• The timestamps indicate login times.

3. Using the w Command

The w command provides more detailed information, including user activity and system load.

Syntax

w

Example Output

 10:25:36 up  2:30,  2 users,  load average: 0.58, 0.45, 0.32
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU  WHAT
user1    tty1     :0               10:15    3:00   0.12s  0.10s  bash
user2    pts/0    192.168.1.100    10:20    1:00   0.05s  0.02s  sshd

Explanation

• Shows system uptime and load average.
• Displays users, their terminals (TTY), remote IPs (FROM), and activity (WHAT).

4. Using the users Command

The users command provides a quick list of logged-in users.

Syntax

users

Example Output

user1 user2

This command is useful for a brief overview without additional details.

5. Using the last Command

The last command shows login history, including past logins.

Syntax

last

Example Output

user1    tty1         :0               Sat Mar 30 10:15   still logged in
user2    pts/0        192.168.1.100    Sat Mar 30 10:20   still logged in
user3    pts/1        192.168.1.101    Fri Mar 29 22:10 - 23:00  (00:50)

Explanation

• Shows users’ login and logout timestamps.
• Indicates if users are still logged in.
• Useful for auditing user activity.

6. Using the finger Command

The finger command provides user details but is not pre-installed in Debian 12.

Installation

sudo apt install finger

Usage

finger

Example Output

Login     Name       TTY      Idle  Login Time   Office
user1     John Doe  tty1     10:00  Mar 30 10:15  Room 101
user2     Alice     pts/0    5:00   Mar 30 10:20  Room 102

This command provides more detailed user information, including office location if configured.

7. Checking Active SSH Sessions

To see active SSH connections, use:

who | grep pts

Alternatively, check SSH logs:

sudo cat /var/log/auth.log | grep 'sshd'

This helps track remote users and potential unauthorized access.

8. Viewing User Processes with ps and top

To see processes of logged-in users:

ps aux | grep `whoami`

For a real-time view:

top

These commands help monitor resource usage per user.

9. Monitoring User Logins in Real-Time

To monitor logins in real-time, use:

tail -f /var/log/auth.log

This command tracks authentication events and login attempts.

Conclusion

Debian 12 provides multiple commands to check logged-in users. The who, w, and users commands offer quick insights, while last and finger provide historical and detailed information. Monitoring user activity is crucial for system security and resource management. By mastering these tools, you can effectively manage your Debian system and ensure authorized access.

Further Reading

• Debian System Administration Guide
• man who, man w, man users, man last, man finger for detailed command usage.

By using these commands, you can effectively track user sessions and enhance security on your Debian 12 Bookworm system.