Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible for a non-root user to hide themselves from the output of who/w, so that they can be logged in without other users seeing it?

I think that the file /var/run/utmp might have something to do with this, but it's not writeable by non-root users (permission 644). I'm fairly certain that this can be done by a non-privileged user (because someone told me that they were able to do so), but I don't know how they did it and can't ask them right now.

Any ideas?

share|improve this question

Against the old version (wtmp/utmp) you could do something like

$ ssh server xterm

and you would have a term up that didn't show up in wtmp.

However, newer distributions use wtmpx/utmpx, which doesn't suffer from this problem.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .