How to alter output from the 'who' and 'w' command?

Question

I don't want my users to see each others ip's/login info so I want to alter the output when they use the 'who' and 'w' commanda to hide that info - is there a way to do this?

Answer 1

Not globaly, no. You could however, restrict access to /usr/bin/w and put an alternative file as /usr/local/bin/w. That could be a simply script that calls the original tool with parameters and filter arguments, and a setuid statement.

Things like:

w -hus | tr -s ' ' | cut -d' ' -f5-

etc.

Answer 2

The information used by w and who is kept in /var/run/utmp or /run/utmp (sometimes /etc/utmp in old systems). You need to restrict read access to that file.

(Don't bother with removing the commands; if you leave utmp readable, anyone can get the addresses with a two-minute script.)

---

However, this will not hide other users' login names. For this, you have to prevent ordinary users from seeing all processes – which can only be done with such kernel patches as grsec. (If you are going to grant access to random, untrusted people, grsec may be a good idea anyway.)

Second, if you're going for privacy, you would have to prevent users from listing all system accounts; this cannot be done with traditional Unix /etc/passwd, since restricting read access to it would break many things. Instead, you would need a separate user directory, such as sssd, LDAP, perhaps some SQL database.

Answer 3

By default the FROM field in w is only shown to root and not to 'regular' users. Assuming your users are on regular accounts, they shouldn't see the details you are seeing. If your compiled version does do this, then use the -f switch to suppress the information:

w -f

You could add this as an alias for w on user profiles (~/.bash_profile):

alias w='w -f'

Answer 4

You could think about giving your users a restricted shell and set up a special bin-directory for them, where you have wrapped or special versions of "w" and "who". See the bash manpage section RESTRICTED SHELL.