Take the 2-minute tour ×

Is it possible for a non-root user to hide themselves from the output of who/w, so that they can be logged in without other users seeing it?

I think that the file /var/run/utmp might have something to do with this, but it's not writeable by non-root users (permission 644). I'm fairly certain that this can be done by a non-privileged user (because someone told me that they were able to do so), but I don't know how they did it and can't ask them right now.

Any ideas?

share|improve this question

1 Answer 1

Against the old version (wtmp/utmp) you could do something like

$ ssh server xterm

and you would have a term up that didn't show up in wtmp.

However, newer distributions use wtmpx/utmpx, which doesn't suffer from this problem.

share|improve this answer

Your Answer


