Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I don't want my users to see each others ip's/login info so I want to alter the output when they use the 'who' and 'w' commanda to hide that info - is there a way to do this?

share|improve this question

4 Answers 4

Not globaly, no. You could however, restrict access to /usr/bin/w and put an alternative file as /usr/local/bin/w. That could be a simply script that calls the original tool with parameters and filter arguments, and a setuid statement.

Things like:

w -hus | tr -s ' ' | cut -d' ' -f5-

etc.

share|improve this answer

The information used by w and who is kept in /var/run/utmp or /run/utmp (sometimes /etc/utmp in old systems). You need to restrict read access to that file.

(Don't bother with removing the commands; if you leave utmp readable, anyone can get the addresses with a two-minute script.)


However, this will not hide other users' login names. For this, you have to prevent ordinary users from seeing all processes – which can only be done with such kernel patches as grsec. (If you are going to grant access to random, untrusted people, grsec may be a good idea anyway.)

Second, if you're going for privacy, you would have to prevent users from listing all system accounts; this cannot be done with traditional Unix /etc/passwd, since restricting read access to it would break many things. Instead, you would need a separate user directory, such as sssd, LDAP, perhaps some SQL database.

share|improve this answer

By default the FROM field in w is only shown to root and not to 'regular' users. Assuming your users are on regular accounts, they shouldn't see the details you are seeing. If your compiled version does do this, then use the -f switch to suppress the information:

w -f

You could add this as an alias for w on user profiles (~/.bash_profile):

alias w='w -f'
share|improve this answer
    
This is incorrect for the default Linux procps w/who, nor the one from BSDs. They show all fields to everyone, since all data is stored in a single world-readable utmp file anyway. (On some systems, w needs the -f option to show the field, on others - to hide it, but that's merely a compile-time preference.) –  grawity Dec 28 '11 at 12:54
    
Unfortunately this does not seem to be the case with CentOS 5. Even regular users see the from field. –  james Dec 28 '11 at 12:58

You could think about giving your users a restricted shell and set up a special bin-directory for them, where you have wrapped or special versions of "w" and "who". See the bash manpage section RESTRICTED SHELL.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.