LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-15-2003, 03:48 AM   #1
Hacker
LQ Newbie
 
Registered: Nov 2001
Location: Georgia
Distribution: RH 9.0
Posts: 27

Rep: Reputation: 15
Linux last login info


hello all!
when i log in into linux machine with ssh, it displays last login info, and can i edit ro delete this info ?
 
Old 07-15-2003, 04:33 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984
you can't delete it, do you mean you just don't want to see it? in that case things like that are normally in /etc/issue.net for network logins. or in the ssh server config itself... /etc/ssh/sshd_config typically
 
Old 07-15-2003, 05:21 AM   #3
Hacker
LQ Newbie
 
Registered: Nov 2001
Location: Georgia
Distribution: RH 9.0
Posts: 27

Original Poster
Rep: Reputation: 15
this is in the /etc/issue.net
--
Red Hat Linux release 9 (Shrike)
Kernel \r on an \m
 
Old 07-15-2003, 05:29 AM   #4
MasterC
LQ Guru
 
Registered: Mar 2002
Location: Salt Lake City, UT - USA
Distribution: Gentoo ; LFS ; Kubuntu
Posts: 12,612

Rep: Reputation: 69
What about /etc/ssh/sshd_config ? Anything staring back at you from there?

Cool
 
Old 07-17-2003, 01:39 PM   #5
Rumblefish
Member
 
Registered: Jun 2003
Location: Delaware
Distribution: Redhat 7.0, 7.2, 8.0, 9.0, FreeBSD 4.6.2
Posts: 51

Rep: Reputation: 15
Actually I can't seem to find anything in either file mentioned that details the last login. The only lines there are for OS version, kernel version and chipset.

I'm curious about this myself, I've never looked into it. Any other ideas where it may be? Perhaps in the shell-specific files, since it only displays after a successful login (and displays the same whether you connect via SSH or telnet)?
 
Old 07-17-2003, 03:50 PM   #6
phoeniXflame
Member
 
Registered: Feb 2003
Location: Somewhere, UK
Distribution: Slack, OpenBSD, Debian, SuSE
Posts: 189

Rep: Reputation: 30
just out of interest ... why would you want to do this ? are we talking about trying to change this without root ?
 
Old 07-18-2003, 05:40 AM   #7
DIYLinux
Member
 
Registered: Jul 2003
Location: NL
Distribution: My own
Posts: 92

Rep: Reputation: 18
Actually, it is possible to edit login info. Most local and remote login programs log to /var/log/utmp (This filename is compiled into glibc. Need to edit and recompile it if you want to use another location). This file contains information who logged in, where and when, in a binary format. I don't know any simple interface to modify this data, so you may have to learn C. Checkout getutmp(3) and friends.

Of course, your system should be configured not to allow anyone other than root to edit /var/log/* files. They are an important target for crackers (!= hackers) who try to remove evidence of their exploits.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[Security Questions] Last Login, how good is this feature for security breach info? t3gah Linux - Security 2 06-14-2005 02:02 AM
I need some info about linux xedios Linux - Software 9 07-30-2004 06:17 PM
automatical feeding of login info in to a site pippet Linux - Software 0 07-23-2004 04:52 AM
i need info on linux!! tangy Linux - Newbie 29 11-22-2003 09:17 AM
info on linux completely_new Linux - Newbie 5 07-17-2003 07:02 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:27 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration