Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?

So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.

EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.


  • Ubuntu 11.04 != Ubuntu 12.04.
    – user
    Jul 2 '12 at 13:17
  • Note that this information can also be requested by running last $USER. Jul 2 '12 at 13:36
  • @MichaelKjörling what do you mean?
    – Gnijuohz
    Jul 2 '12 at 13:41
  • != is commonly read as "is not equal to". You wrote Ubuntu 12.04 in the text of the question, but used the ubuntu-11.04 tag. The two are not equivalent, so one or the other must be wrong.
    – user
    Jul 2 '12 at 13:43
  • @MichaelKjörling sorry,I didn't notice my tag was wrong. Thanks!
    – Gnijuohz
    Jul 2 '12 at 13:46

In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.

  • 3
    This isn't a proper answer.
    – deprecated
    Oct 14 '16 at 18:04

In ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

PrintLastLog yes

and change to

PrintLastLog no (or add if it doesnt exist)

Don't forget to restart your ssh by writing service ssh restart

  • 5
    dont forget, youll need to restart ssh with the following command: service ssh restart this will all need to be done with root/sudo Jul 2 '12 at 13:20
  • Thanks, but I want to find the file(s) that has(ve) the info more.
    – Gnijuohz
    Jul 2 '12 at 13:48
  • oh, sorry, looks like ott got this one. Jul 2 '12 at 14:02
  • I believe your problem will be solved by deleting the following files: /var/log/wtmp and /var/log/btmp and possibly /var/log/utmp. There may be other files in /var/log that have user logon data (such as /var/log/wtmp.1) so you'll have to wipe those too Jul 2 '12 at 14:05
  • No need to be sorry. Your help is much appreciated~
    – Gnijuohz
    Jul 2 '12 at 14:06

utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.


The PrintLastLog configuration keyword pulls information from the /var/log/lastlog file

You can use the command lastlog, to view this information at the command line.


Here's an alternative which works for GNU and BSD (Mac OS X). It also accounts for the fact most settings are commented out by default - they are in El Capitan anyway):

sudo sed -i.bak "s/^#?PrintLastLog yes$/^PrintLastLog no$/" /etc/ssh/sshd_config

Without the -i.bak change I kept getting:

sed: 1: "/etc/ssh/sshd_config": bad flag in substitute command: 'h'

Here Is The Command To Do This Automatically:

sudo sed -i "s/PrintLastLog .*/PrintLastLog no/1" /etc/ssh/sshd_config

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.