Extra root user present in Alma10 as systemd, is that normal?

[Richard G]

Normally when I use the command to see who's online as root I only see 1 root user.
Now on a VPS I see 2 root users, however, one is a systemd user, but this works confusing to me.

Is this something new in Alma 10 and normal? Or is this an odd situation, instantly is present again after a reboot.

[root@server: ~]# w
 23:24:32 up 6 min,  2 users,  load average: 0.08, 0.10, 0.05
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT
root               23:24    6:31   0.00s  0.01s sshd-session: root [priv]
root               23:24    6:31   0.00s  0.09s /usr/lib/systemd/systemd --user

The sshd-session that's me so that's normal, but I havent seen the second one ever before as being always present.

 

[exlhost]

This is completely normal on modern Linux distributions using systemd, such as Debian, AlmaLinux, RHEL, etc.

You are not actually seeing a “second root user”, but two processes/sessions associated with the same root login.

Example:

[root@server: ~]# w
23:24:32 up 6 min,  2 users,  load average: 0.08, 0.10, 0.05
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT
root               23:24    6:31   0.00s  0.01s sshd-session: root [priv]
root               23:24    6:31   0.00s  0.09s /usr/lib/systemd/systemd --user

The first entry:

sshd-session: root [priv]

is your actual SSH login session handled by sshd.

The second entry:

/usr/lib/systemd/systemd --user

is the per-user systemd instance for the root user.

On modern systemd-based systems, every logged-in user often gets their own:

systemd --user

process, which manages user-level services such as:

- user dbus
- timers
- sockets
- runtime directories
- PAM/systemd session integration
- lingering user services

So this is:

- NOT an extra root account
- NOT a second login
- NOT a backdoor
- NOT suspicious

It is simply part of normal systemd session management.

You can verify this with:

ps -ef | grep "systemd --user"

or:

loginctl

You will usually see something similar to:

SESSION  UID USER SEAT  TTY
1          0 root       pts/0

You can also inspect the root user session with:

loginctl show-user root

And to view the process tree:

pstree -p

You will typically see something like:

sshd
 └─sshd-session
     └─bash
         └─systemd --user

So in short: completely normal behavior on modern Linux systems using systemd.