Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to set the FROM field in /usr/bin/w to various different strings that aren't my sshd's opinion of where the user has come from. Mostly this is because inbound ssh is often via on-host relays (eg a port 80 HTTP proxy, or a browser-based ssh gateway) so the w column gives localhost in that case. Making it list inbound tor connections with a tor annotation would be nice also.

Is there a way to do this? (eg somewhere in PAM perhaps?)

share|improve this question

I checked some docs and code and apparently there's no way to do that. The FROM utmp field is set by sshd that uses a reverse DNS lookup to find what to use there, and sshd doesn't have many options on how to manipulate it. Take a look on the -u option from sshd to read a little about it (and see what fails in case of incorrect or inexistent DNS lookips):

 -u len  This option is used to specify the size of the field in
             the utmp structure that holds the remote host name.  If
             the resolved host name is longer than len, the dotted
             decimal value will be used instead.  This allows hosts
             with very long host names that overflow this field to
             still be uniquely identified.  Specifying -u0 indicates
             that only dotted decimal addresses should be put into
             the utmp file.  -u0 may also be used to prevent sshd
             from making DNS requests unless the authentication mech‐
             anism or configuration requires it.  Authentication
             mechanisms that may require DNS include
             RhostsRSAAuthentication, HostbasedAuthentication, and
             using a from="pattern-list" option in a key file.  Con‐
             figuration options that require DNS include using a
             USER@HOST pattern in AllowUsers or DenyUsers.
share|improve this answer
another thought i had was that I can have a setuid program that tidies up the utmp entry to the form I want, run in bash_profile. Not sure that I can make it mandatory, but it will at run by default. – Ben Clifford Apr 26 '11 at 12:15
If you are going there you can make it a pam module and add it to the pam chain. – coredump Apr 26 '11 at 13:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.