I have hit the googles as much as I can on this, being specific to OS X, I am not finding an answer. Nothing is wrong, but curiosity levels are high.
$ssh email@example.com Password: Last login: Wed Apr 7 21:28:03 2010 from my-laptop.local ^lonely tylenol^
- Line 1 is my command
- line 2 is the shell asking for the password
- line 3 is where my question comes from
- line 4 comes out of /etc/motd
I can find nothing in ~/ of an of the .bash* files that contains the string "Last Login", and would like to alter it. It performs some type of hostname lookup, which I can not determine.
If I ssh to another host:
$ssh firstname.lastname@example.org Last login: Wed Apr 7 21:14:51 2010 from 123-234-321-123-some.cal.isp.net.example hi there, you are on box 456
- line 1 is my command
- line 2 is again, where my question comes from
- line 3 is from /etc/motd
*The dash'd IP address is not reversed
On this remote host, I have ~/.ssh and it's corresponding keys set up, so there was no password request
Where is the "Last Login:" coming from, where does the date stamp come from, and most importantly, where does the hostname come from?
While on email@example.com (box 456)
Or with dig, to make sure I have rDNS/PTR set up, for which I am not authoritative, but my ISP has correctly set...
$dig -x 123.234.321.123 PTR remote.location.example456.com
$dig PTR 123.321.234.123.in-addr.arpa. +short remote.location.example456.com.
hostname used to be 123-234-321-123-some.cal.isp.net.example, which I set with
hostname -s remote.location.example456.com, because it was obnoxious to see such a long name. That solves the value of $echo
hostname which now returns remote.location.example456.com.
Mac OS X, 10.6 is this case, does seem to honor:
If leave that file empty, I get nothing on the shell when I login. I want to know what controls the host resolution of the IP, and how it is all working. For example, running
last reports a huge list of my logins, which have obtusely long hostnames, when they would be preferable to just be remote.location.example456.com.
More confusing to me, reading the man page for
lastlog, it looks like lastlog is not used on OS X, /var/log/lastlog does not exist. Actually, none of these exist on 10.5 or 10.6:
/var/run/utmp The utmp file. /var/log/wtmp The wtmp file. /var/log/lastlog The lastlog file.
If I am to assume that the system is doing some kind of reverse lookup, I certainly do not know what it is, as it is not an accurate one.