who tips — authorized utmp session literacy
who helps authorized labs sample utmp-style session literacy on hosts they own. Pair with w-tips, lastlog-tips, login-tips, lastb-tips, whoami-tips. Prefer lab VMs — never enumerate utmp on foreign hosts without permission.
Snapshot
| Field | Value |
|---|---|
| Surface | who tip checklist |
| Job | Authorized utmp session literacy |
| w peer | w-tips |
| Last-login peer | lastlog-tips |
| Login peer | login-tips |
| Identity peer | whoami-tips |
Tip checklist (authorized only)
- Confirm you may run
whoon the lab host (syllabus box you own or were given access to). - Prefer documenting who / why / ticket before collecting utmp Evidence.
- Record short factual notes; quote short Evidence (name, line, time — never passwords).
- Optional: richer session summary → w-tips.
- Optional: last-login DB → lastlog-tips.
- Optional: current effective user → whoami-tips.
- Redact usernames/hostnames before Evidence leaves the lab binder.
- Stop at literacy — no attack or unauthorized session-stalking cookbooks.
Allowed framing
- Classroom labs reviewing
who/who -a/who -bon authorized hosts. - Binding short factual notes as Evidence (name/line/time only — no secrets).
- Documenting expected vs observed login counts for authorized inventory notes.
- Comparing who ↔ w / lastlog / whoami peer tip pages under one binder.
- Testing
who -qhead-count drills when the syllabus authorizes them.
Scope we will not cover
- No crack/pirate/keygen via utmp tools.
- No intentional stalking or unauthorized enumeration against foreign hosts.
- No secret-theft or credential dumping against hosts you do not own.
- No cookbooks that forge utmp/wtmp entries without authorization.
Beginner path (authorized only)
- Obtain one syllabus-approved lab host with coreutils installed.
- Run
who(orwho -a); quote 1–2 redacted rows as Evidence. - Optional: pair session summary with w-tips; last-login with lastlog-tips.
- Optional: identity literacy with whoami-tips.
- Stop at literacy — no attack or unauthorized utmp-enumeration cookbooks.
Practical notes for authorized labs
who -b(boot time) andwho -q(count) are binder-friendly inventory facts.- Prefer lab accounts with known logins so Evidence stays reproducible.
- Never paste full remote-host lists into public binders — redact to lab labels.
- Pair with login-tips when reviewing how sessions are established.
- Label lab-only noisy logins clearly so they are not mistaken for production posture.
- If utmp/wtmp paths differ by distro, quote the path the syllabus documents — do not invent paths.
FAQ-aligned refusals (quick)
- Foreign-host utmp stalking → refuse.
- Sharing unredacted user/host dumps in public binders → refuse.
- Attack cookbooks via who → refuse.
- Prefer authorized, redacted, secret-free Evidence.
- Use w / lastlog / whoami peer tip pages when the syllabus asks.
- No crack or unauthorized-access framing.
For legal, authorized and educational use only.
FAQ
What is a "who tip" page in BinBench framing?
A checklist for reading authorized utmp-style session Evidence (who output) on hosts you own or were given syllabus access to — not a cookbook for stalking users on foreign servers.
How does this relate to w-tips / lastlog-tips / login-tips?
w-tips covers logged-in session summaries; lastlog-tips covers last-login DB; login-tips covers login-session literacy. This page zooms on a general who tip checklist — it does not overwrite those pages.
Can I run who against hosts I do not own?
No. Authorization first. BinBench will not publish unauthorized utmp enumeration against foreign hosts.
Does this teach attack PoCs via who?
No. Mentions of attack/bypass appear only as refusals. Authorized literacy only — prefer lab VMs and redacted samples.
Does this teach secret theft via who?
No. Never paste passwords or full accounting dumps into notes. Redact usernames and hostnames when Evidence leaves the lab.