Re: login can be used to hide from finger under SunOS 4.13u1

[watson@edfub8 (Paul)]

> I recently noticed that running login (no arguments) once logged in, and 
> providing it with your username and password would hide one from finger 
> requests under SunOS 4.13u1.  Has anybody else noticed this, under SunOS, or 
> other unix variants?
>    David Sacerdote

Another way to hide from "who" commands is to perform a "login"
from "sh" and login as sync account (if left without passwd).
After doing this a "whoami" will still report your normal username,
but a "who" command will show sync as logged in instead of the
real user.
EXAMPLE:
edfub8> who
watson   ttyp1   Jun  3 11:36   (:0.0)
watson   ttyp4   Jun  3 12:36
edfub8> whoami
watson
edfub8> sh
$ login
login: sync
***MOTD goes here***
edfub8> who
sync     ttyp1   Jun  3 12:42
watson   ttyp4   Jun  3 12:36
edfub8> whoami
watson

Of course, the utmp file on SunOS is rw-rw-rw- so if a person
really wanted to change the "who" table it would be trivial
anyway....
================================================================
| Paul A. Watson                 |   Current Assignment:       | 
| System Administrator           |   USAF 611 OSS/TBX          |
| Email: watson () ctis af mil.     |   Anchorage, AK             |
================================================================