Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of setting up a hosting machine that clients will have SSH access to. We don't want them to be able to see a list of user accounts, but the problem we have run into are commands like w and who.

We could disable those, but then they could just bring their own binary. I just tried on a shared webhost, and I was the only user who showed up in w, even though it's a large shared box and I doubt I'm the only one on.

How can I prevent users from seeing who else has logged in via SSH?

share|improve this question
up vote 3 down vote accepted

w and who basically read the data from /var/run/utmp. If you change the permissions of it to say 660 that will prevent users being able to read it.

share|improve this answer

You can disable the command by running chmod 700 /usr/bin/who. I'd do this in addition to Mlfe's answer.

This will disable execution for all users except root.

share|improve this answer
My understanding is that just making /user/bin/who unexecutable is insufficient because a user could simply bring another who binary and run it from their home directory. – Tom Marthenal Jul 27 '12 at 19:28
It is, I just said use it in addition :) – Lucas Kauffman Jul 27 '12 at 19:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.