Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are in the process of setting up a hosting machine that clients will have SSH access to. We don't want them to be able to see a list of user accounts, but the problem we have run into are commands like w and who.

We could disable those, but then they could just bring their own binary. I just tried on a shared webhost, and I was the only user who showed up in w, even though it's a large shared box and I doubt I'm the only one on.

How can I prevent users from seeing who else has logged in via SSH?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

w and who basically read the data from /var/run/utmp. If you change the permissions of it to say 660 that will prevent users being able to read it.

share|improve this answer
add comment

You can disable the command by running chmod 700 /usr/bin/who. I'd do this in addition to Mlfe's answer.

This will disable execution for all users except root.

share|improve this answer
    
My understanding is that just making /user/bin/who unexecutable is insufficient because a user could simply bring another who binary and run it from their home directory. –  Tom Marthenal Jul 27 '12 at 19:28
    
It is, I just said use it in addition :) –  Lucas Kauffman Jul 27 '12 at 19:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.