who/w/finger/last printing ip address

[Michael Grant]

I'm running debian testing.  Just did an apt-get update.  who, w, finger, and last are all now printing the ip address instead of the hostname.  the wtmp seems to have the ip address now instead of the hostname.  Last shows hostnames up to when I did the apt-get update today and then ip addresses.

Is this expected?  Is something in the works and this is in the process of changing?

I have to say in some ways this seems like a feature not a bug!  I've long missed the option some other unixes have to inhibit resolving the name.  But at the moment the hostname!  Frankly, there should be an option to w, who, finger, and last to not resolve the addresses.  

[Martin Read]

On 05/09/15 23:21, Michael Grant wrote:
> I have to say in some ways this seems like a feature not a bug! I've
> long missed the option some other unixes have to inhibit resolving the
> name. But at the moment the hostname! Frankly, there should be an
> option to w, who, finger, and last to not resolve the addresses.

Such options are clearly documented in the man pages for three of those
four utilities.

last -i prints IP addresses.
last -d prints resolved hostnames.

w -i or --ip-addr prints IP addresses.

who --ips prints IP addresses instead of hostnames
who --lookup attempts to canonicalize hostnames

There doesn't appear to be a corresponding option for finger.

[Michael Grant]

Any idea why I'm NOT getting hostnames by default?

$ who
mgrant   pts/1        2015-09-05 07:30 (10.20.30.40:S.1)
mgrant   pts/2        2015-09-05 07:30 (10.20.30.40:S.2)
mgrant   pts/3        2015-09-05 07:30 (10.20.30.40:S.3)
mgrant   pts/4        2015-09-05 07:30 (10.20.30.40:S.4)
$ w
 07:34:29 up 3 days, 6 min,  4 users,  load average: 0.03, 0.06, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
mgrant   pts/1    10.20.30.40:S. Sat07   26:48m  0.09s  0.09s /bin/bash
$  finger
Login     Name            Tty      Idle  Login Time   Office     Office Phone
mgrant    Michael Grant   pts/1      1d  Sep  5 07:30 (10.20.30.40:S.1)
mgrant    Michael Grant   pts/2   14:12  Sep  5 07:30 (10.20.30.40:S.2)
mgrant    Michael Grant   pts/3          Sep  5 07:30 (10.20.30.40:S.3)
mgrant    Michael Grant   pts/4      3d  Sep  5 07:30 (10.20.30.40:S.4)

[Reco]

Hi.

Because your host is unable to resolve the IPs to hostnames, maybe?
What does 'getent hosts 10.20.30.40' show?

Reco

[Michael Grant]

(I of course edited my own host's ip address here for 10.20.30.40)

But yes, getent resolves my host ip to a name.  who/w/finger/last all still do not resolve the host.

[Reco]

Hi.

On Wed, Sep 09, 2015 at 10:46:53AM +0100, Michael Grant wrote:
> (I of course edited my own host's ip address here for 10.20.30.40)
>
> But yes, getent resolves my host ip to a name.  who/w/finger/last all still do not resolve the host.

Ok, then we'll have to do it the hard way.

Please post the output of 'strace w'.

Reco

[Reco]

Hi.

On Wed, Sep 09, 2015 at 01:18:34PM +0100, Michael Grant wrote:

> $ getent hosts 10.20.30.40
> 10.20.30.40   host10-20-30-40.example.com
> $ w
>  05:46:33 up 3 days, 22:18,  4 users,  load average: 0.04, 0.07, 0.06

> USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT

> mgrant   pts/1    10.20.30.40:S. Sat07   22:05m  0.09s  0.09s /bin/bash
> mgrant   pts/2    10.20.30.40:S. Sat07   22:05m  0.27s  0.05s /bin/bash
> mgrant   pts/3    10.20.30.40:S. Sat07    0.00s  6.00s  0.07s /bin/bash
> mgrant   pts/4    10.20.30.40:S. Sat07    3days  0.57s  0.57s emacs
> $ strace w
> execve("/usr/bin/w", ["w"], [/* 25 vars */]) = 0
<abridged>
> exit_group(0)                           = ?
> +++ exited with 0 +++

Ok. This strace output clearly shows that 'w' does not even trying to
resolve IPs to hostnames.

Hence, even more hard way should be tried - looking at the source.

'w' you're using should belong to 'procps' package, source of which is
here:

git://git.debian.org/collab-maint/procps.git

The source file for 'w' is, unsurprisingly, 'w.c', which has this check:

if (from)
print_from(u, ip_addresses, fromlen);

So, basically they decide to print hostnames only of 'from' variable is
set to 0, which is set in 'main' function to '1' initially:

/* switches (defaults) */
int header = 1;
int longform = 1;
int from = 1;

For reasons unknown, 'from' can be set to 0 initially if one is using
W_SHOWFROM compilation flag. This flag is set for squeeze's procps, but
unset starting with wheezy (as far as I can tell):

#ifndef W_SHOWFROM
from = 0;
#endif


'-f' flag for 'w', which, according to the manpage, should enable
IP->hostname resolving, merely inverts 'from' flag:

while ((ch =
getopt_long(argc, argv, "husfoVi", longopts, NULL)) != -1)
switch (ch) {
case 'h':
header = 0;
break;
case 'l':
longform = 1;
break;
case 's':
longform = 0;
break;
case 'f':
from = !from;
break;


And, as the cherry on a pie, there's this commit
e14b7c261042020b19f73a032be53d7728b6c29f, dated 6 Jan 2012, aptly named
"Imported Upstream version 3.3.2", which changed default 'from' value
from '0' to '1'.


So, long story short, last version of 'w' which printed hostnames by
default should be squeeze's one, and even then they used compilation
flag to make it do so.

Reco

[David Wright]

Quoting Reco (recov...@gmail.com):

> So, long story short, last version of 'w' which printed hostnames by
> default should be squeeze's one, and even then they used compilation
> flag to make it do so.

I'm trying to follow this, but it doesn't seem to square with my own
observations.

I've edited the following output to pertinent entries in context
(you don't need my TV's hostname/IP#).

west runs jessie, alum runs wheezy. jessie first:

west ~ $ w
11:31:01 up 4:41, 24 users, load average: 0.13, 0.13, 0.14

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

david tty1 07:06 1:50m 60.68s 0.25s -bash
david pts/0 :0 07:06 2:13m 0.08s 0.08s bash
...
david pts/3 :0 07:06 50.00s 0.55s 0.47s ssh -X alum
...
david pts/16 :0 07:06 0.00s 0.09s 0.00s w
...
david pts/20 :0 07:06 3:55 0.42s 0.33s ssh -X alum
david pts/21 alum 11:30 8.00s 0.19s 0.19s -bash
david tty2 10:02 48:17 0.31s 0.19s -bash
west ~ $ getent hosts
127.0.0.1 localhost
127.0.1.1 west
192.168.1.1 router
...
192.168.1.13 wasp
192.168.1.17 agog
192.168.1.19 alum
127.0.0.1 ip6-localhost ip6-loopback
west ~ $ w -i
11:35:31 up 4:45, 24 users, load average: 0.01, 0.07, 0.11

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

david tty1 07:06 1:55m 1:02 0.25s -bash
david pts/0 :0 07:06 2:17m 0.08s 0.08s bash
...
david pts/3 :0 07:06 23.00s 0.67s 0.59s ssh -X alum
...
david pts/16 :0 07:06 1:35 0.10s 0.10s bash
...
david pts/20 :0 07:06 8:25 0.42s 0.33s ssh -X alum
david pts/21 192.168.1.19 11:30 4:38 0.19s 0.19s -bash
david tty2 10:02 52:47 0.31s 0.19s -bash
west ~ $

and wheezy (nobody at the console):

alum ~ $ w
11:38:31 up 5:38, 5 users, load average: 0.00, 0.01, 0.05

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

david pts/0 west 10:48 11:27 1.01s 0.00s -bash
...
david pts/3 west 11:30 7:40 0.19s 0.04s ssh -X west
david pts/4 west 11:38 7.00s 0.16s 0.00s w
alum ~ $ getent hosts
127.0.0.1 localhost
127.0.1.1 alum
192.168.1.1 router
...
192.168.1.13 wasp
192.168.1.15 west
192.168.1.17 agog
127.0.0.1 localhost ip6-localhost ip6-loopback
alum ~ $ w -i
w: invalid option -- 'i'

Usage:
...
alum ~ $

Note: the router does no DNS for the local network, only the
internet. Sorry I'm no longer running squeeze.

Cheers,
David.

[Reco]

Hi.

On Wed, Sep 09, 2015 at 11:50:17AM -0500, David Wright wrote:
> Quoting Reco (recov...@gmail.com):
>
> > So, long story short, last version of 'w' which printed hostnames by
> > default should be squeeze's one, and even then they used compilation
> > flag to make it do so.
>
> I'm trying to follow this, but it doesn't seem to square with my own
> observations.

Ok. As they say - 'there should be a logical explanation for this' :)

> I've edited the following output to pertinent entries in context
> (you don't need my TV's hostname/IP#).

Indeed. They are irrelevant in this case.

> west runs jessie, alum runs wheezy. jessie first:
>
> west ~ $ w

< 'w' showing hostnames skipped >

> alum ~ $ w -i
> w: invalid option -- 'i'

This. Since 'w' from 'procps' package clearly supports '-i' flag - it
means you use some different 'w'. Please post the output of:

ls -al /usr/bin/w
ls -al /etc/alternatives/w

Reco

[David Wright]

west ~ $ ls -l /usr/bin/w /etc/alternatives/w /usr/bin/w.procps
lrwxrwxrwx 1 root root 17 Oct 10 2012 /etc/alternatives/w -> /usr/bin/w.procps
lrwxrwxrwx 1 root root 19 Oct 10 2012 /usr/bin/w -> /etc/alternatives/w
-rwxr-xr-x 1 root root 17896 Mar 6 2015 /usr/bin/w.procps
west ~ $ man w | grep ' 201'
procps-ng May 2012 W(1)
west ~ $ dpkg -L procps | grep /w
/usr/share/man/de/man1/w.1.gz
/usr/share/man/man1/watch.1.gz
/usr/share/man/man1/w.procps.1.gz
/usr/bin/w.procps
/usr/bin/watch
west ~ $

Now wheezy:

alum ~ $ ls -l /usr/bin/w /etc/alternatives/w /usr/bin/w.procps
lrwxrwxrwx 1 root root 17 May 5 2014 /etc/alternatives/w -> /usr/bin/w.procps
lrwxrwxrwx 1 root root 19 May 5 2014 /usr/bin/w -> /etc/alternatives/w
-rwxr-xr-x 1 root root 17916 Mar 28 2013 /usr/bin/w.procps
alum ~ $ man w | grep ' 201'
procps-ng June 2011 W(1)
alum ~ $ dpkg -L procps | grep /w
/usr/bin/watch
/usr/bin/w.procps
/usr/share/man/man1/w.procps.1.gz
/usr/share/man/man1/watch.1.gz
/usr/share/man/de/man1/w.1.gz
alum ~ $

Cheers,
David.

[Reco]

Hi.

Ok, I stand corrected. Last version of 'w' which shows hostnames by
default seems to be 3.3.3 they put in wheezy:

First, wheezy's 'w' did not have '-i' option at all.

Second, wheezy's debian/rules contains this '--enable-w-from' configure
option that I missed:

override_dh_auto_configure:
./configure \
--build=$(DEB_BUILD_GNU_TYPE) \
--enable-watch8bit --enable-w-from \
--enable-skill \
--prefix=/usr \
--exec-prefix=/ \
--libdir=/usr/lib/$(DEB_HOST_MULTIARCH)

Reco

[Michael Grant]

$ ls -al /usr/bin/w
lrwxrwxrwx 1 root root 19 Feb 11  2014 /usr/bin/w -> /etc/alternatives/w
$ ls -al /etc/alternatives/w
lrwxrwxrwx 1 root root 17 Feb 11  2014 /etc/alternatives/w -> /usr/bin/w.procps
$ w -V
w from procps-ng 3.3.10

$ who --version
who (GNU coreutils) 8.23

also "who --lookup" makes no attempt to look up the ip addresses either. 

So is this now the expected behavior in Debian?

[Reco]

Hi.

Yup. They build it that way.
Upstream thinks it's the sane default, and Debian tries to stay close to
the upstream.

Reco