1. Find the logged user on the system and see what are the user doing. In this example, we are going to kick root, pts/5 user. Right now, he is doing something with /etc/passwd file.
# w 22:45:15 up 372 days, 13:24, 2 users, load average: 1.22, 0.83, 0.43 USER TTY LOGIN@ IDLE JCPU PCPU WHAT root pts/1 22:24 0.00s 0.09s 0.02s w root pts/5 20:21 20:38 0.11s 0.01s vi /etc/passwd
2. Look for the process ID based on the TTY.
# ps t | grep pts/5 22445 pts/9 S+ 0:00 grep pts/5
3. Kill the process ID.
# kill -9 22445
4. Verify the user is online or not!
