Take the 2-minute tour ×  Is it possible for a non-root user to
hide themselves from the output of who/w, so that they can be
logged in without other users seeing it?  I think that the file
/var/run/utmp might have something to do with this, but it's not
writeable by non-root users (permission 644). I'm fairly certain
that this can be done by a non-privileged user (because someone
told me that they were able to do so), but I don't know how they
did it and can't ask them right now.  Any ideas?  share|improve
this question  1 Answer 1  Against the old version (wtmp/utmp)
you could do something like  $ ssh server xterm  and you would
have a term up that didn't show up in wtmp.  However, newer
distributions use wtmpx/utmpx, which doesn't suffer from this
problem.  share|improve this answer  Your Answer