Daniel van Eeden wrote:
I found out that it is posible for local users on tty1 to hide themselves from the output of the "w" command if they use gnu screen. 1. start a screen session as normal user and detach. 2. login as that user on tty1 (not tty2) 3. run "w" and verify that your session is listed. 4. run "screen -r" and detach. 5. now you're not listed in the output of the "w" command. I'm running Debian Sid pure64 on AMD64 with login, screen, udev, kernel 2.6.9, etc. all installed from the debs. There seems to be a difference in the output of w and who. It seems like a blank line is reported instead of the desired information. It won't work if not connected to /dev/tty1 Could anybody confirm this?
They can also remove a logged-in sessions `w' entry by doing a "ctrl-A L" while attached.
man screen:
[...]
C-a L (login) Toggle this windows login slot. Available only
if screen is configured to update the utmp
database.
[...]
I do not know if this can be disabled or not, possibly by recompiling.
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature