[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: screen lets local users on tty1 remove themselves from the output of w

Pardom my ignorance, but,

man w

w - Show who is logged on and what they are doing.

If you use screen and detach, you are not login anymore, in other
words, you can't interactively do anything. You can leave things
running that's for sure.

And since screen is a SUID program (owned by root), and root is always
login,... the behaviour you describe makes a lot of sense to me:
$> ls -l /usr/bin/screen
-rwxr-sr-x  1 root utmp 305K 2004-11-14 13:26 /usr/bin/screen

Why don't you use "lastlog" instead and see who's login (or when they
login last).

On Fri, 31 Dec 2004 16:37:14 +0100, Daniel van Eeden <daniel_e@dds.nl> wrote:
> I found out that it is posible for local users on tty1 to hide
> themselves from the output of the "w" command if they use gnu screen.
> 1. start a screen session as normal user and detach.
> 2. login as that user on tty1 (not tty2)
> 3. run "w" and verify that your session is listed.
> 4. run "screen -r" and detach.
> 5. now you're not listed in the output of the "w" command.
> I'm running Debian Sid pure64 on AMD64 with login, screen, udev, kernel
> 2.6.9, etc. all installed from the debs.
> There seems to be a difference in the output of w and who.
> It seems like a blank line is reported instead of the desired
> information.
> It won't work if not connected to /dev/tty1
> Could anybody confirm this?
> --
> Daniel van Eeden <daniel_e@dds.nl>

Luis M
System Administrator

"We think basically you watch television to turn your brain off, and
you work on your computer when you want to turn your brain on" --
Steve Jobs in an interview for MacWorld Magazine 2004-Feb

No .doc: http://www.fsf.org/philosophy/no-word-attachments.es.html

Reply to: