Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 07-15-2003, 03:48 AM   #1
LQ Newbie
Registered: Nov 2001
Location: Georgia
Distribution: RH 9.0
Posts: 27

Rep: Reputation: 15
Linux last login info

hello all!
when i log in into linux machine with ssh, it displays last login info, and can i edit ro delete this info ?
Old 07-15-2003, 04:33 AM   #2
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984Reputation: 1984
you can't delete it, do you mean you just don't want to see it? in that case things like that are normally in /etc/ for network logins. or in the ssh server config itself... /etc/ssh/sshd_config typically
Old 07-15-2003, 05:21 AM   #3
LQ Newbie
Registered: Nov 2001
Location: Georgia
Distribution: RH 9.0
Posts: 27

Original Poster
Rep: Reputation: 15
this is in the /etc/
Red Hat Linux release 9 (Shrike)
Kernel \r on an \m
Old 07-15-2003, 05:29 AM   #4
LQ Guru
Registered: Mar 2002
Location: Salt Lake City, UT - USA
Distribution: Gentoo ; LFS ; Kubuntu ; CentOS ; Raspbian
Posts: 12,613

Rep: Reputation: 69
What about /etc/ssh/sshd_config ? Anything staring back at you from there?

Old 07-17-2003, 01:39 PM   #5
Registered: Jun 2003
Location: Delaware
Distribution: Redhat 7.0, 7.2, 8.0, 9.0, FreeBSD 4.6.2
Posts: 51

Rep: Reputation: 15
Actually I can't seem to find anything in either file mentioned that details the last login. The only lines there are for OS version, kernel version and chipset.

I'm curious about this myself, I've never looked into it. Any other ideas where it may be? Perhaps in the shell-specific files, since it only displays after a successful login (and displays the same whether you connect via SSH or telnet)?
Old 07-17-2003, 03:50 PM   #6
Registered: Feb 2003
Location: Somewhere, UK
Distribution: Slack, OpenBSD, Debian, SuSE
Posts: 189

Rep: Reputation: 30
just out of interest ... why would you want to do this ? are we talking about trying to change this without root ?
Old 07-18-2003, 05:40 AM   #7
Registered: Jul 2003
Location: NL
Distribution: My own
Posts: 92

Rep: Reputation: 18
Actually, it is possible to edit login info. Most local and remote login programs log to /var/log/utmp (This filename is compiled into glibc. Need to edit and recompile it if you want to use another location). This file contains information who logged in, where and when, in a binary format. I don't know any simple interface to modify this data, so you may have to learn C. Checkout getutmp(3) and friends.

Of course, your system should be configured not to allow anyone other than root to edit /var/log/* files. They are an important target for crackers (!= hackers) who try to remove evidence of their exploits.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[Security Questions] Last Login, how good is this feature for security breach info? t3gah Linux - Security 2 06-14-2005 02:02 AM
I need some info about linux xedios Linux - Software 9 07-30-2004 06:17 PM
automatical feeding of login info in to a site pippet Linux - Software 0 07-23-2004 04:52 AM
i need info on linux!! tangy Linux - Newbie 29 11-22-2003 09:17 AM
info on linux completely_new Linux - Newbie 5 07-17-2003 07:02 PM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:06 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration