26

Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?

So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.

EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.

Thanks.

Improve this question
6
  • Ubuntu 11.04 != Ubuntu 12.04.
    – user
    Commented Jul 2, 2012 at 13:17
  • Note that this information can also be requested by running last $USER.
    – Jaap Eldering
    Commented Jul 2, 2012 at 13:36
  • @MichaelKjörling what do you mean?
    – Gnijuohz
    Commented Jul 2, 2012 at 13:41
  • != is commonly read as "is not equal to". You wrote Ubuntu 12.04 in the text of the question, but used the ubuntu-11.04 tag. The two are not equivalent, so one or the other must be wrong.
    – user
    Commented Jul 2, 2012 at 13:43
  • @MichaelKjörling sorry,I didn't notice my tag was wrong. Thanks!
    – Gnijuohz
    Commented Jul 2, 2012 at 13:46

7 Answers 7

Reset to default
7

In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.

Improve this answer
1
  • 4
    This isn't a proper answer.
    – deprecated
    Commented Oct 14, 2016 at 18:04
66

In Debian and Ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

#PrintLastLog yes

And change it to:

PrintLastLog no

(Or add it if not existing.)

Don't forget to restart your ssh daemon:

service ssh restart
Improve this answer
6
  • 6
    dont forget, youll need to restart ssh with the following command: service ssh restart this will all need to be done with root/sudo
    – Cameron Aziz
    Commented Jul 2, 2012 at 13:20
  • Thanks, but I want to find the file(s) that has(ve) the info more.
    – Gnijuohz
    Commented Jul 2, 2012 at 13:48
  • oh, sorry, looks like ott got this one.
    – Cameron Aziz
    Commented Jul 2, 2012 at 14:02
  • I believe your problem will be solved by deleting the following files: /var/log/wtmp and /var/log/btmp and possibly /var/log/utmp. There may be other files in /var/log that have user logon data (such as /var/log/wtmp.1) so you'll have to wipe those too
    – Cameron Aziz
    Commented Jul 2, 2012 at 14:05
  • No need to be sorry. Your help is much appreciated~
    – Gnijuohz
    Commented Jul 2, 2012 at 14:06
4

utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.

Improve this answer
3

The PrintLastLog configuration keyword pulls information from the /var/log/lastlog file

You can use the command lastlog, to view this information at the command line.

Improve this answer
2

if "last login" is the only information printed, then you can also try hushlogin. This will suppress all information during login and is controllable per user.

touch $HOME/.hushlogin

You can refer login manpage for more information.

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Apr 5, 2022 at 11:28
1

Here's an alternative which works for GNU and BSD (Mac OS X). It also accounts for the fact most settings are commented out by default - they are in El Capitan anyway):

sudo sed -i.bak "s/^#?PrintLastLog yes$/^PrintLastLog no$/" /etc/ssh/sshd_config

Without the -i.bak change I kept getting:

sed: 1: "/etc/ssh/sshd_config": bad flag in substitute command: 'h'
Improve this answer
0

Here Is The Command To Do This Automatically:

sudo sed -i "s/PrintLastLog .*/PrintLastLog no/1" /etc/ssh/sshd_config
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .