The Tech

This is an old one, though still works on most systems Today. In Linux, the command ‘w‘ or ‘who‘ will display all logged in users in theory. However via SSH it is possible to hide a session from ‘w’ and ‘who’. How?

As long as your SSH client has the option to disable pseudo-tty allocation, then you are good. The majority of Linux SSH clients will have that option under the ‘-T’ flag. By running the following command on my Linux box it hides the session from both ‘w’ and ‘who’. Give it a try.

ssh user@hostname -T

Keep in mind a session without pseudo-tty have it’s limitations. Some programs such as screen, w, more, tail, head are unable to work because they are unable to display the output. Also interrupt keys may not work.

 

Why is this good to know?

Well if you are a Linux person you now know not to always rely on ‘w’ and ‘who’. Instead use the ‘ps’ command to see who and what is running on your system. Also don’t forget grep is your friend for filtering outputs.

ps -aux | more

or

ps -aux | grep bash (look at the running shells for a quick look)

There you have it.