Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?

So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.

EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.

Thanks.

share|improve this question
    
Ubuntu 11.04 != Ubuntu 12.04. – Michael Kjörling Jul 2 '12 at 13:17
    
Note that this information can also be requested by running last $USER. – eldering Jul 2 '12 at 13:36
    
@MichaelKjörling what do you mean? – Gnijuohz Jul 2 '12 at 13:41
    
!= is commonly read as "is not equal to". You wrote Ubuntu 12.04 in the text of the question, but used the ubuntu-11.04 tag. The two are not equivalent, so one or the other must be wrong. – Michael Kjörling Jul 2 '12 at 13:43
    
@MichaelKjörling sorry,I didn't notice my tag was wrong. Thanks! – Gnijuohz Jul 2 '12 at 13:46
up vote 7 down vote accepted

In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.

share|improve this answer

In ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

PrintLastLog yes

and change to

PrintLastLog no (or add if it doesnt exist)

share|improve this answer
1  
dont forget, youll need to restart ssh with the following command: service ssh restart this will all need to be done with root/sudo – Cameron Aziz Jul 2 '12 at 13:20
    
Thanks, but I want to find the file(s) that has(ve) the info more. – Gnijuohz Jul 2 '12 at 13:48
    
oh, sorry, looks like ott got this one. – Cameron Aziz Jul 2 '12 at 14:02
    
I believe your problem will be solved by deleting the following files: /var/log/wtmp and /var/log/btmp and possibly /var/log/utmp. There may be other files in /var/log that have user logon data (such as /var/log/wtmp.1) so you'll have to wipe those too – Cameron Aziz Jul 2 '12 at 14:05
    
No need to be sorry. Your help is much appreciated~ – Gnijuohz Jul 2 '12 at 14:06

utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.

share|improve this answer

The PrintLastLog configuration keyword pulls information from the /var/log/lastlog file

You can use the command lastlog, to view this information at the command line.

share|improve this answer

Here's an alternative which works for GNU and BSD (Mac OS X). It also accounts for the fact most settings are commented out by default - they are in El Capitan anyway):

sudo sed -i.bak "s/^#?PrintLastLog yes$/^PrintLastLog no$/" /etc/ssh/sshd_config

Without the -i.bak change I kept getting:

sed: 1: "/etc/ssh/sshd_config": bad flag in substitute command: 'h'
share|improve this answer

Here Is The Command To Do This Automatically:

sudo sed -i "s/PrintLastLog .*/PrintLastLog no/1" /etc/ssh/sshd_config
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .