[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: screen lets local users on tty1 remove themselves from the output of w



I did reproduce it on my alpha running Debian 3.0

And it seems like I'm still logged on and all programs are just running
fine and I can still use the bash prompt which executed screen. The last
command says I'm still logged in, but w and who won't show my session.

Daniel van Eeden <daniel_e@dds.nl>

On Fri, 2004-12-31 at 11:51 -0500, Luis M wrote:
> Pardom my ignorance, but,
> 
> man w
> 
> w - Show who is logged on and what they are doing.
> 
> If you use screen and detach, you are not login anymore, in other
> words, you can't interactively do anything. You can leave things
> running that's for sure.
> 
> And since screen is a SUID program (owned by root), and root is always
> login,... the behaviour you describe makes a lot of sense to me:
> $> ls -l /usr/bin/screen
> -rwxr-sr-x  1 root utmp 305K 2004-11-14 13:26 /usr/bin/screen
> 
> Why don't you use "lastlog" instead and see who's login (or when they
> login last).
> 
> 
> On Fri, 31 Dec 2004 16:37:14 +0100, Daniel van Eeden <daniel_e@dds.nl> wrote:
> > I found out that it is posible for local users on tty1 to hide
> > themselves from the output of the "w" command if they use gnu screen.
> > 
> > 1. start a screen session as normal user and detach.
> > 2. login as that user on tty1 (not tty2)
> > 3. run "w" and verify that your session is listed.
> > 4. run "screen -r" and detach.
> > 5. now you're not listed in the output of the "w" command.
> > 
> > I'm running Debian Sid pure64 on AMD64 with login, screen, udev, kernel
> > 2.6.9, etc. all installed from the debs.
> > 
> > There seems to be a difference in the output of w and who.
> > It seems like a blank line is reported instead of the desired
> > information.
> > 
> > It won't work if not connected to /dev/tty1
> > 
> > Could anybody confirm this?
> > --
> > Daniel van Eeden <daniel_e@dds.nl>
> > 
> > 
> > 
> 
> 
-- 
Daniel van Eeden <daniel_e@dds.nl>

Attachment: smime.p7s
Description: S/MIME cryptographic signature


Reply to: