Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?

So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.

EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.

Thanks.

share|improve this question
    
Ubuntu 11.04 != Ubuntu 12.04. –  Michael Kjörling Jul 2 '12 at 13:17
    
Note that this information can also be requested by running last $USER. –  eldering Jul 2 '12 at 13:36
    
@MichaelKjörling what do you mean? –  Gnijuohz Jul 2 '12 at 13:41
    
!= is commonly read as "is not equal to". You wrote Ubuntu 12.04 in the text of the question, but used the ubuntu-11.04 tag. The two are not equivalent, so one or the other must be wrong. –  Michael Kjörling Jul 2 '12 at 13:43
    
@MichaelKjörling sorry,I didn't notice my tag was wrong. Thanks! –  Gnijuohz Jul 2 '12 at 13:46

5 Answers 5

up vote 6 down vote accepted

In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.

share|improve this answer

In ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

PrintLastLog yes

and change to

PrintLastLog no (or add if it doesnt exist)

share|improve this answer
    
dont forget, youll need to restart ssh with the following command: service ssh restart this will all need to be done with root/sudo –  Cameron Aziz Jul 2 '12 at 13:20
    
Thanks, but I want to find the file(s) that has(ve) the info more. –  Gnijuohz Jul 2 '12 at 13:48
    
oh, sorry, looks like ott got this one. –  Cameron Aziz Jul 2 '12 at 14:02
    
I believe your problem will be solved by deleting the following files: /var/log/wtmp and /var/log/btmp and possibly /var/log/utmp. There may be other files in /var/log that have user logon data (such as /var/log/wtmp.1) so you'll have to wipe those too –  Cameron Aziz Jul 2 '12 at 14:05
    
No need to be sorry. Your help is much appreciated~ –  Gnijuohz Jul 2 '12 at 14:06

utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.

share|improve this answer

The PrintLastLog configuration keyword pulls information from the /var/log/lastlog file

You can use the command lastlog, to view this information at the command line.

share|improve this answer

Here Is The Command To Do This Automatically:

sudo sed -i "s/PrintLastLog .*/PrintLastLog no/1" /etc/ssh/sshd_config
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.