1

I don't want my users to see each others ip's/login info so I want to alter the output when they use the 'who' and 'w' commanda to hide that info - is there a way to do this?

4 Answers 4

1

Not globaly, no. You could however, restrict access to /usr/bin/w and put an alternative file as /usr/local/bin/w. That could be a simply script that calls the original tool with parameters and filter arguments, and a setuid statement.

Things like:

w -hus | tr -s ' ' | cut -d' ' -f5-

etc.

1

The information used by w and who is kept in /var/run/utmp or /run/utmp (sometimes /etc/utmp in old systems). You need to restrict read access to that file.

(Don't bother with removing the commands; if you leave utmp readable, anyone can get the addresses with a two-minute script.)


However, this will not hide other users' login names. For this, you have to prevent ordinary users from seeing all processes – which can only be done with such kernel patches as grsec. (If you are going to grant access to random, untrusted people, grsec may be a good idea anyway.)

Second, if you're going for privacy, you would have to prevent users from listing all system accounts; this cannot be done with traditional Unix /etc/passwd, since restricting read access to it would break many things. Instead, you would need a separate user directory, such as sssd, LDAP, perhaps some SQL database.

0

By default the FROM field in w is only shown to root and not to 'regular' users. Assuming your users are on regular accounts, they shouldn't see the details you are seeing. If your compiled version does do this, then use the -f switch to suppress the information:

w -f

You could add this as an alias for w on user profiles (~/.bash_profile):

alias w='w -f'
2
  • This is incorrect for the default Linux procps w/who, nor the one from BSDs. They show all fields to everyone, since all data is stored in a single world-readable utmp file anyway. (On some systems, w needs the -f option to show the field, on others - to hide it, but that's merely a compile-time preference.) Dec 28, 2011 at 12:54
  • Unfortunately this does not seem to be the case with CentOS 5. Even regular users see the from field.
    – james
    Dec 28, 2011 at 12:58
0

You could think about giving your users a restricted shell and set up a special bin-directory for them, where you have wrapped or special versions of "w" and "who". See the bash manpage section RESTRICTED SHELL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .