How can I hide a user from the who listing?

Question

Is it possible for a non-root user to hide themselves from the output of who/w, so that they can be logged in without other users seeing it?

I think that the file /var/run/utmp might have something to do with this, but it's not writeable by non-root users (permission 644). I'm fairly certain that this can be done by a non-privileged user (because someone told me that they were able to do so), but I don't know how they did it and can't ask them right now.

Any ideas?

Answer 1

Against the old version (wtmp/utmp) you could do something like

$ ssh server xterm

and you would have a term up that didn't show up in wtmp.

However, newer distributions use wtmpx/utmpx, which doesn't suffer from this problem.