Script "nc-who" - similar to unix `who`, follow live who is logged in

ernolf · June 26, 2023, 8:45pm

Have you ever wanted to check who’s online right now, if there’s any suspicious movement happening on your cloud?
Similar to unix who, follow live who is logged in with

→ `nc-who` ←

I have completely reworked this script, which was originally created here

It has a completely revised output. Since it updates at an adjustable refresh rate with watch, the formatted output from mysql was no longer usable. The solution was to output as html and back with html2text and sed in a usable, nice and neat format.
Nextcloud All-in-One is supported, containerized solutions other than AIO are not (yet) supported

This tool is primarily intended for administrators of Nextcloud instances with many users. Of course, this is not intended for small servers used in familiary circles. But they can also want to take a look and then the tool is not far:

~~Restriction: only for MySQL/MariaDB~~ Supported databases: MySQL/MariaDB, PostgreSQL

This script was created with → ebtb ← .

Install this way:

sudo wget -qO /usr/local/bin/nc-who https://global-social.net/script/nc-who
sudo chmod +x /usr/local/bin/nc-who
nc-who

Explanation:
- the first line downloads the script into the directory /usr/local/bin
- the second line makes it executable

You only need to install it once.
As all of my → ebtb ← scripts, it comes signed and does an integrity check on the first run and checks for updates on every startup.

Simply run:

nc-who monitor

or

nc-who last

There is a “god mode”. Example screen:

 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

   This is the GOD MODE of nc-who.

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

I: Here you can invalidate cookies before they expire by deleting the corresponding authtoken from the
   database.
⚠: The user whose authtoken is deleted, thereby invalidating their cookie, must log in again using their
   credentials and, if configured, a second factor. An ongoing session will also be closed. Error
   messages may occur if the user continues to attempt to retrieve new data, so use this feature only
   after careful consideration.
   If you enter the full word  panic , all cookies will be invalidated and all users will have to log in
   again.
   This applies only to cookie-based browser connections; connections using app tokens are not affected.

+-----------------------------------------------------------------------------------------------------------------+
| pos | last_activity       | status | uid            | client                                                    |
+-----+---------------------+--------+----------------+-----------------------------------------------------------+
|     |                     |        |                | Mozilla/5.0                                               |
| 1   | 2025-04-02 17:28:35 | online | Long_User_Name | (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36    |
|     |                     |        |                | (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36        |
|     |                     |        |                | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/    |
| 2   | 2025-04-02 17:28:02 | online | user           | 537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/       |
|     |                     |        |                | 537.36 OPR/117.0.0.0                                      |
| 3   | 2025-04-02 17:27:26 | away   | user           | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/    |
|     |                     |        |                | 537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 |
|     |                     |        |                | Mozilla/5.0                                               |
| 4   | 2025-04-02 12:08:50 | away   | Long_User_Name | (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/ |
|     |                     |        |                | 605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mo...    |


Please select:

             [pos]  - pos number from the authtoken you want to invalidate

             panic  - invalidate all cookie based tokens

             [ b ]  - go back to selection

             [ q ]  - quit

Enter [pos],  panic , [ b ] or [ q ]:

much luck with it.

ernolf

==========================================

PayPal:
PayPal.Me @ernolf
Github Sponsors:
Github Sponsors @ernolf
Bitcoin to
bc1qwlcqc7zsak45vwqk0dt7hnxlrta7syzstgf7t8
Ethereum, BNB Smart Chain, Polygon to
0x72b7901b3daa45a7266A77Aa3B3552aB686d0D0D
Solana to
E7e13hBB7rmhY2N1MqAY88TKobBktJA7rSpTZWAPec6Y

==========================================

abyss02 · June 26, 2023, 9:45pm

Only mysql as database, pgsql is not yet supported by this script

What a pity …

ernolf · June 26, 2023, 10:03pm

@abyss02 try the newest version, I integrated PostgreSQL support for you.

JimmyKater · June 28, 2023, 6:05am

Well done!

I kinda like to move this thread to “howto”-category. What do you think about it, @ernolf ?

Aww and is there any chance. making this an app for appstore with kind of like a html (or whatever)-output for admins?

anyway… great work!

ernolf · June 28, 2023, 10:24am

done

abyss02 · July 5, 2023, 6:32am

Wooo, works great …

ernolf · July 5, 2023, 8:08am

Thank you for your kind feedback! I am happy that postgre - thanks to you - works now

ernolf · August 11, 2023, 2:30pm

I’ve increased the functionality of nc-who a bit again. Specialy the last_login function could be interesting for some admins but the realtime login status in monitor view as well.

Here the new help screen:

Help:

  nc-who - Version 2024-02-28 14:02 (latest version)

  This utility is similar to the Unix `who` command, allowing you to monitor
  live user logins and activities on your nextcloud server-instance.

  Usage:
    nc-who -h|--help
    nc-who monitor
    nc-who last
    nc-who integrity_check

  Options:

    -h|--help       Display this help message.

    monitor     Monitor live user logins, ordered by last activity at an
                adjustable refresh rate.
                * Login status is only available for cookie-based sessions
                  on a web frontend.
                * Last activity is shown for all clients.

    last        List users sorted by their last login time. This is equivalent
                to the output of `occ user:lastseen --all`
                * `--all` is actually not available for that occ command.

    integrity_check
                verify the integrity of this script with signature

Those of you who already have it installed (version 2023.06.29 or newer) only need to call the script and the update will be offered automatically.

Feedback welcome!

Continued luck

ernolf

atomic · December 29, 2023, 2:44pm

Found a small bug in the current nc-who script.
If using nc dbpass with “$” sign, line 400 fails because “$” is used unescaped.

It must read:

eval '$DB_STRG' $DB_EXEC\"$db_query\"$

ernolf · December 29, 2023, 3:01pm

Thank you very much for your feedback!

Your Issue is verry good, I did realy not test it with passwords containing ‘$’

Could you please restart the script, it will ask to update and try if it now works.

ernolf

atomic · December 29, 2023, 3:02pm

That was fast. It works now. Thanks.

ernolf · December 29, 2023, 3:28pm

Unfortunately this breaks support for postgresql. I will have to develop a better solution.

Much luck,
ernolf

ernolf · December 29, 2023, 10:54pm

Now I hope it supports all kind of passwords for both, MySQL/MariaDB and PostgrSQL.

@atomic : does it still work?

ernolf

Sylvain2 · May 7, 2024, 5:09am

Hello @ernolf

Thanks for the link from this thread

You doesn’t edit the bash script “minified”, right?
Is there a repository around with the code in a mode readable format?

What does it brings to “minify” a bash script? is it obfuscation?

Thanks any way I’ll look at it.

Regards,
Sylvain.

ernolf · May 7, 2024, 7:39am

Hi @Sylvain,

thank you for your interest,

I initially developed my scripts as monolithic standalone entities. However, given that many of the steps within most scripts remained consistent, I transitioned to modular scripting. This switch not only expedited development but also yielded significant enhancements applicable across my entire script collection.

Upon initiating the nc-who script, the necessary modules are loaded into the /usr/local/include/ernolf/prod/ directory. You’re welcome to explore the contents there.

Essentially, nc-who functions as a module loader with sequence control.

I am actually used to write my code “minified” this way because I can let it run better in my mind’s eye that way. I have consistently implemented this as an approach in the Module Loader, which I’ve optimized for compactness, ensuring minimal space consumption. The objective is to render it as “stable and solid as a rock,” given its foundational role in all of my scripts.
The loaded modules are more “human readable” formatted though

I host all my scripts on my personal server and have devised a custom build and commit framework. This framework handles all aspects of publication, including GPG signing, hashing, and versioning. I find platforms like Github or Codeberg too restrictive, as they lack the flexibility I require, I feel far too restricted in processes that I didn’t develop myself.
However, I’m happy to share the code if you specify the exact portion you’re interested in.

nc-who represents one of my simpler scripts. In addition to standard modules for color, text formatting, and interactive question/answer functionality etc., it relies on the “nextcloud” module for configuration data retrieval, the “nextcloud_db” module for interacting with the Nextcloud database, and the “nc-who/monitor” and “nc-who/last” modules, which execute the script’s tasks.

ernolf

ernolf · May 7, 2024, 9:45am

Maybe this will help you:

nc-who monitor basically makes this database query that repeats itself at an adjustable time interval:

MySQL:

SELECT FROM_UNIXTIME(at.last_activity) AS last_activity,
                        CASE
                          WHEN at.type = '0' AND at.remember = '1' THEN (SELECT us.status FROM oc_user_status us WHERE us.user_id = at.uid)
                          ELSE 'n.a.'
                        END AS status, 
                        at.uid, at.name AS client
                      FROM oc_authtoken at WHERE at.type = '0' AND at.remember = '1'
                      ORDER BY at.last_activity DESC

PostgreSQL:

SELECT TO_TIMESTAMP(at.last_activity) AS last_activity,
                        CASE
                          WHEN at.type = '0' AND at.remember = '1' THEN (SELECT us.status FROM oc_user_status us WHERE us.user_id = at.uid)
                          ELSE 'n.a.'
                        END AS status, 
                        at.uid, at.name AS client
                      FROM oc_authtoken at WHERE at.type = '0' AND at.remember = '1'
                      ORDER BY at.last_activity DESC

All the rest of the code is to format it correctly on as many terminals as possible, including less wide TTYs, and to make it work out of the box on as many systems as possible.

Much and good luck,
ernolf

ernolf · June 6, 2024, 1:37am

Meanwhile there is:

ernolf

ernolf · June 17, 2024, 9:10pm

Nextcloud All-in-One is now supported, containerized solutions other than AIO are not (yet) supported

ernolf

Ruben-cipo · November 26, 2024, 1:23pm

Hola @ernolf !

Voy a escribir en castellano ( mi nativo ) por si fallo en la traducción, pero intentaré traducir al final.

Me gustó mucho el trabajo, y creo que puede ser muy útil.
Soy administrador de sistemas y en un servidor que corro con NC, estaba interesado en verificar que los usuarios que permanecieran conectados, fueran los que correspondían.

Para probar el script tengo una máquina virtual en casa con NC y pude ver algo que no sé si es un error, más bien un detalle que puede desconcertar la primera vez.

Si no hay ningún usuario conectado, la pantalla no muestra nada, ni el cursor ya que está oculto, lo que no debería ser un resultado deseado. Sería más informativo mostrar todo el encabezado del resultado y ningún usuario listado o un mensaje informando que no hay usuarios conectados.
La primera vez que corrí el monitor por ejemplo, al no haber usuarios, la pantalla quedó en blanco ( en negro en realidad ), luego de una espera que consideré razonable, intenté dar por terminada la prueba y salí con Ctl+C , pensando que podía estar “colgado”. Entonces volvió a la terminal, pero el cursor continuó oculto, lo que es algo incómodo.

Aún no he tenido tiempo de revisar todas las rutinas del directorio /usr/include/ebtb/prod/ , y aquí es donde el código “legible” y los comentarios nos permitirían ser de más ayuda para poder modificar y probar, para ayudar en la solución.

Bueno, por una entrada es demasiado.
Gracias por compartir tus conocimientos y tu trabajo !
@Ruben-cipo

Hi @ernolf !
I’m going to write in Spanish (my native) in case I fail in the translation, but I’ll try to translate in the end.
I really enjoyed the work, and I think it can be very useful.
I am a sysadmin and on a server that I run with NC, I was interested in verifying that the users who remained connected were the correct ones.
To test the script I have a virtual machine at home with NC and I could see something that I don’t know if it’s an error, but rather a detail that can be disconcerting the first time.
If there are no users logged in, the screen displays nothing, not even the cursor as it is hidden, which should not be a desired result. It would be more informative to show the entire result header and no users listed or a message informing that there are no users logged in.
For example, the first time I ran the monitor, when there were no logged in users, the screen went blank (actually black), after a wait that I considered reasonable, I tried to end the test and exited with Ctl+C , thinking that it might be “hanging”. Then it returned to the terminal, but the cursor remained hidden, which is somewhat inconvenient.
I haven’t had time to review all the routines in the /usr/include/ebtb/prod/ directory yet, and this is where “human readable” code, and comments would be of more help to us in modifying and testing, to aid in the solution.
Well, for one entry that’s too much.
Thank you for sharing your knowledge and your work!
@Ruben-cipo

ernolf · November 26, 2024, 2:55pm

Hi @Ruben-cipo ,

thank you very much for your feedback,

Absolutely correct. The cursor is hidden there.
If you want to test the script, you should log in with some users. Without that, the script does not make any sense at all.

But, with all due respect, that is not the script’s job to say that nobody is logged in when nobody is logged in. That somehow follows automatically from the empty display.
If you call unix `who`, you aint get no negative messages either, only who is realy loged in at present…

It sometimes needs a little time for all TRAPS to execute, in order to bring the cursor back. In some rare situations that does not work proper. I don’t know how you exactly testet it and what your terminal settings are.
However, it is better to abort with “q” as provided by the script.
Or was the first line (like this):

 coockie based logins, refresh rate = 5 s. - [s] change refresh rate - [r] reload - [b] back - [q] quit

not displayed either?

You can find the code on github. It is part of ebtb

I have described there, how you can build the code with your own local module server.
However, I haven’t tried it for a while now to see if it still works with the local server. If there are any problems, I’ll be happy to help or make the necessary adjustments to the code when I get the chance.

You are welcome to PM me for further details.

Buena suerte,
ernolf

Script "nc-who" - similar to unix `who`, follow live who is logged in

→ nc-who ←

MySQL:

PostgreSQL:

→ `nc-who` ←