I connected through ssh, run tc****p and export it in pcap file, waited over 2 hours, did it 9 times (9 different pcap files) but in all of them for user1 and 2 I only got the crypt values, the only simple was for ROOT but with no data, am I missing something?
Edit: Nr10 pcap did the job!
On to root, o*****l is a nightmare! any hints are welcome!!
Edit2: rooted! Thanks @brianma for your help!