I know it’s a long shot but just in case other people have encountered this issue:
I’m creating a brand new VPS with ubuntu 18.04 and virtualmin. I have root user and I have a “domain” user that was created as part of the virtual server/domain/site I created on the new VPS.
After it was created I ran: loginctl list-sessions and saw X sessions. After awhile it got up to 91 then 99 and now 103. It seems that the number is increasing but nothing removes them from the list. Their TTY is ???.
Should it be like that? Something operates behind the scenes that is causing it? Anything special I should check for? Because the user is responsible for the virtual server defined in virtualmin, I guess it is related to how virtualmin operates?
After another 12 hours: 209 sessions. I checked several of them and they are Active=yes and State=closing. I followed these instructions: https://www.thegeekstuff.com/2011/05/openssh-options/ and put 150 and 2 respectively but it doesn’t see to do any effect.
Thank you for the tip. I did a small test. I logged in using SSH with user root, logged out and then re-logged in again. As expected I see 2 sessions for root. using loginctl session-status ID I see one active and one closing (as expected) but the closing remains like that “for good”.
I checked loginctl session-status ID for user domain and the state is closing as if the connection is made and immediately closed but remains in the list.
journalctl -xe |grep session ; shows that a new session has started for user domain and that’s it. I don’t see any source that opened the session.
In /etc/systemd/system.conf everything is commented out. Is there something I should set there?
I have no idea why domain user keeps connecting to the system in order to know how to stop it. Obviously it started after I defined the virtual server in virtualmin. That’s the reason I think virtualmin may be the reason but that’s just a guess.
Every 2-3 minutes I see in syslog: systemd[1]: Started Session c... of user domain. Each time c… increased by 1… How can I know who/what is creating those sessions? They are immediately closed but not cleared from the list. has anyone here this kind of logging in his syslog file?