Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?

So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.

EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.


  • Ubuntu 11.04 != Ubuntu 12.04. – Michael Kjörling Jul 2 '12 at 13:17
  • Note that this information can also be requested by running last $USER. – Jaap Eldering Jul 2 '12 at 13:36
  • @MichaelKjörling what do you mean? – Gnijuohz Jul 2 '12 at 13:41
  • != is commonly read as "is not equal to". You wrote Ubuntu 12.04 in the text of the question, but used the ubuntu-11.04 tag. The two are not equivalent, so one or the other must be wrong. – Michael Kjörling Jul 2 '12 at 13:43
  • @MichaelKjörling sorry,I didn't notice my tag was wrong. Thanks! – Gnijuohz Jul 2 '12 at 13:46
up vote 6 down vote accepted

In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.

  • 1
    This isn't a proper answer. – vemv Oct 14 '16 at 18:04

In ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

PrintLastLog yes

and change to

PrintLastLog no (or add if it doesnt exist)

  • 3
    dont forget, youll need to restart ssh with the following command: service ssh restart this will all need to be done with root/sudo – Cameron Aziz Jul 2 '12 at 13:20
  • Thanks, but I want to find the file(s) that has(ve) the info more. – Gnijuohz Jul 2 '12 at 13:48
  • oh, sorry, looks like ott got this one. – Cameron Aziz Jul 2 '12 at 14:02
  • I believe your problem will be solved by deleting the following files: /var/log/wtmp and /var/log/btmp and possibly /var/log/utmp. There may be other files in /var/log that have user logon data (such as /var/log/wtmp.1) so you'll have to wipe those too – Cameron Aziz Jul 2 '12 at 14:05
  • No need to be sorry. Your help is much appreciated~ – Gnijuohz Jul 2 '12 at 14:06

utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.

The PrintLastLog configuration keyword pulls information from the /var/log/lastlog file

You can use the command lastlog, to view this information at the command line.

Here's an alternative which works for GNU and BSD (Mac OS X). It also accounts for the fact most settings are commented out by default - they are in El Capitan anyway):

sudo sed -i.bak "s/^#?PrintLastLog yes$/^PrintLastLog no$/" /etc/ssh/sshd_config

Without the -i.bak change I kept getting:

sed: 1: "/etc/ssh/sshd_config": bad flag in substitute command: 'h'

Here Is The Command To Do This Automatically:

sudo sed -i "s/PrintLastLog .*/PrintLastLog no/1" /etc/ssh/sshd_config

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.