Categories
Hacker

How to kickout illegal ssh user from your unix server ?


Type who the -u flag; the PID is the number off to the right:

> who -u
ec2-user pts/1        2019-11-14 16:52 00:02   16035 (104.245.199.125)
Look up the process ID of the shell their TTY is connected to: 
> ps t   PID   TTY      STAT   TIME COMMAND   16035 pts/1    Ss     0:00 zsh 

Laugh at their impending disconnection (this step is optional, but encouraged) 
> echo "HAHAHAHAHAHAHAHA" | write ec2-user pts/1 

Kill the corresponding process: > kill -9 16035 

Leave a Reply