I want to set up a server with a lot of users so that (in order of importance):

  1. Users cannot obtain ip addresses of other users with who, or last
  2. Users can write to each other
  3. Users are able to selectively mesg n other users, as opposed to simply blocking everyone
  4. [optional] Users cannot wall

Point 1 is easily solved by a chmod 660 on wtmp and utmp, but I don't know how to achieve the other points

The server runs Gentoo Linux

The output of last is:

last: /var/log/wtmp: Permission denied

The output of w is:

 17:04:45 up 36 days,  2:51,  0 users,  load average: 2.34, 2.96, 2.12
  • Do the same for 2. You have to do... nothing for 3 and 4. – quanta Jun 8 '12 at 10:40
  • except that when I do, for example: "write root" I get "write: root is not logged in" – miniBill Jun 8 '12 at 11:23
  • write requires people to be logged on and have a terminal assigned? So, is root logged in and do they have a terminal assigned? – EightBitTony Jun 8 '12 at 11:56
  • it is, and they are logged in via ssh – miniBill Jun 8 '12 at 14:57
  • Please show us the output of w command. Did you try with another user? – quanta Jun 8 '12 at 15:04

The write command essentially writes to a device file such as /dev/pts/1. It seems to consult utmp in order to figure out the correspondence between users and ttys. One can work around this by simply listing the contents of /dev/pts with ls -lh /dev/pts (although it's most probably not needed - see below).

mesg doesn't seem to do anything other than setting or removing the group write permission from the tty device file:

anthony@laura:~$ who am i
anthony  pts/6        Jun 11 17:06 (:0:S.5)
anthony@laura:~$ mesg
is n
anthony@laura:~$ chmod g+w /dev/pts/6
anthony@laura:~$ mesg
is y

The files in /dev/pts belong to group tty. The write command setgids to this group in order to write to them. Therefore, in order to get point (2) working, it should be possible to use ACLs to make utmp readable by group tty:

setfacl -m g:tty:r /var/run/utmp

(Changing utmp so that its group is tty might also work, but who knows what side effects this might have.)

In order to get point (3) working (given that the /dev/pts file system does not support ACLs), I believe you would need to modify write and implement the functionality in it (for example, read a file "allow_mesg" in the target user's home directory and see if the messaging user is listed in there).

  • Thanks :) I knew that point 3 was going to be tricky, but thanks nonetheless for you help. I guess that ACLs are the way to go, provided that write can't leak the ip address from utmp – miniBill Jun 11 '12 at 15:50
  • 1
    write is about 300 lines of C. If it shows the ip address anywhere, it won't be hard to change it. – Antonis Christofides Jun 11 '12 at 15:53
  • Now, if I only could use setfacl on /dev/pts/ files it would solve point 3 too! [Modulo some small checks in write] – miniBill Jun 11 '12 at 16:08

You could use chroot and lock the users into a custom root directory. By doing this, you could point them to whatever versions of mesg, wall, who, etc.

You could also force them into a shell wrapper, and set your controls there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.