Whenever I log into a server using ssh. The prompt gives me "last login" information. I was wondering where this information comes from. How can I remove this record so when someone else log into the same server, the person would see my login info with my ip in it?
So how can I do this? For the record, I am not hacking someone's computer and the server runs Ubuntu 12.04.
EDIT: which file logs this kind of information? If I find the file, then I can do anything to it as root.
Thanks.
Best Answer
In addition to /var/log/lastlog, there are 3 files in
/var/run
and/var/log
:utmp
,wtmp
andbtmp
, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.