samaritan0

-- Find ssh sessions that are hiding from 'w'/'who'
SELECT * FROM (
    SELECT p.pid,p.name,p.cmdline,GROUP_CONCAT(DISTINCT pof.path) AS open_files
    FROM processes p
    LEFT JOIN process_open_files pof ON p.pid = pof.pid
    WHERE p.name = "sshd"
    GROUP BY p.pid
)
WHERE cmdline LIKE "%@notty%"
OR

samaritan0

Keybase proof

I hereby claim:

• I am samaritan0 on github.
• I am samaritan (https://keybase.io/samaritan) on keybase.
• I have a public key whose fingerprint is 563E AF3D BADE A5B6 3B06 241C 1EB7 393E 8033 C913

To claim this, I am signing this object:

samaritan0

Keybase proof

I hereby claim:

• I am dikkemberg on github.
• I am samaritan (https://keybase.io/samaritan) on keybase.
• I have a public key whose fingerprint is 563E AF3D BADE A5B6 3B06 241C 1EB7 393E 8033 C913

To claim this, I am signing this object: