Home / server / Questions / 411940
Accepted
Tom Marthenal
Asked: 2012-07-28 11:09:34 +0800 CST

How to prevent use of `w` and `who` on shared webhosts

  • 772

We are in the process of setting up a hosting machine that clients will have SSH access to. We don't want them to be able to see a list of user accounts, but the problem we have run into are commands like w and who.

We could disable those, but then they could just bring their own binary. I just tried on a shared webhost, and I was the only user who showed up in w, even though it's a large shared box and I doubt I'm the only one on.

How can I prevent users from seeing who else has logged in via SSH?

linux

2 Answers

  1. Best Answer

    w and who basically read the data from /var/run/utmp. If you change the permissions of it to say 660 that will prevent users being able to read it.

    • 3

  2. You can disable the command by running chmod 700 /usr/bin/who. I'd do this in addition to Mlfe's answer.

    This will disable execution for all users except root.

    • 0