• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

Removing Last Login information

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> UNIX // GNU/Linux

View previous topic :: View next topic  
Author Message
Jason
Forum Fanatic
Forum Fanatic


Joined: 19 Sep 2002
Posts: 16777215


Offline

PostPosted: Wed Jan 22, 2003 5:11 pm    Post subject: Removing Last Login information Reply with quote

Hi,

When you login to a box via SSH, it tells you the time of the last login, and the location it came from.

On Redhat 8 / linux generally, where is this information kept, and how can you modify it?

Cheers,

J
Back to top
View user's profile Send private message Send e-mail
vlad902
Just Arrived
Just Arrived


Joined: 04 Jan 2003
Posts: 0


Offline

PostPosted: Wed Jan 22, 2003 5:40 pm    Post subject: Reply with quote

/var/log
Back to top
View user's profile Send private message
Jason
Forum Fanatic
Forum Fanatic


Joined: 19 Sep 2002
Posts: 16777215


Offline

PostPosted: Wed Jan 22, 2003 5:44 pm    Post subject: Reply with quote

Give us a clue... Smile

Quote:
-rw------- 1 root root 63380 Jan 22 10:20 boot.log
-rw------- 1 root root 8042 Jan 22 15:01 cron
-rw-r--r-- 1 root root 7709 Jan 22 10:20 dmesg
drwxr-xr-x 2 root root 4096 Jan 22 10:20 gdm
-rw-r--r-- 1 root root 66566 Jan 22 10:20 ksyms.0
-rw-r--r-- 1 root root 66566 Jan 21 20:06 ksyms.1
-rw-r--r-- 1 root root 66566 Jan 21 20:01 ksyms.2
-rw-r--r-- 1 root root 66566 Jan 21 19:50 ksyms.3
-rw-r--r-- 1 root root 66566 Jan 21 19:38 ksyms.4
-rw-r--r-- 1 root root 66566 Jan 21 16:53 ksyms.5
-rw-r--r-- 1 root root 66566 Jan 21 04:05 ksyms.6
-r-------- 1 root root 19136220 Jan 22 15:41 lastlog
-rw------- 1 root root 12735 Jan 22 11:26 maillog
-rw------- 1 root root 262730 Jan 22 15:41 messages
-rw-r--r-- 1 root root 13256 Jan 22 11:26 rpmpkgs
-rw-r--r-- 1 root root 8824 Jan 20 01:11 scrollkeeper.log
-rw------- 1 root root 9177 Jan 22 15:41 secure
-rw------- 1 root root 0 Jan 20 01:04 spooler
drwxr-xr-x 2 root root 4096 Jul 1 2002 vbox
-rw-rw-r-- 1 root utmp 174336 Jan 22 15:41 wtmp
-rw-r--r-- 1 root root 25902 Jan 22 10:21 XFree86.0.log
-rw-r--r-- 1 root root 25902 Jan 20 01:18 XFree86.1.log
Back to top
View user's profile Send private message Send e-mail
Jason
Forum Fanatic
Forum Fanatic


Joined: 19 Sep 2002
Posts: 16777215


Offline

PostPosted: Wed Jan 22, 2003 5:46 pm    Post subject: Reply with quote

"lastlog" does contain my last login, but its a long file, with a load of other crap in it ^@^@^@^@^@ etc.

Safe to delete?
Back to top
View user's profile Send private message Send e-mail
ShaolinTiger
Forum Fanatic
Forum Fanatic


Joined: 18 Apr 2002
Posts: 16777215
Location: Kuala Lumpur, Malaysia

Offline

PostPosted: Wed Jan 22, 2003 6:23 pm    Post subject: Reply with quote

Shaolin:~# lastlog --help
Usage: lastlog [-u login-name] [-t days]
Back to top
View user's profile Send private message Visit poster's website
Jason
Forum Fanatic
Forum Fanatic


Joined: 19 Sep 2002
Posts: 16777215


Offline

PostPosted: Wed Jan 22, 2003 10:17 pm    Post subject: Reply with quote

That only lets me see last logins. I want to remove that information from the system.
Back to top
View user's profile Send private message Send e-mail
vlad902
Just Arrived
Just Arrived


Joined: 04 Jan 2003
Posts: 0


Offline

PostPosted: Thu Jan 23, 2003 1:45 am    Post subject: Reply with quote

I think you have to use something special to edit that file, I believe it's in binary.
Back to top
View user's profile Send private message
squidly
Trusted SF Member
Trusted SF Member


Joined: 07 Oct 2002
Posts: 16777215
Location: Umm.. I dont know.. somewhere

Offline

PostPosted: Thu Jan 23, 2003 2:03 am    Post subject: Reply with quote

The last logins are usualy held in the wtmp file and utmp files. If you want to remove the display of them look in your dot files (.profile .login .bashrc ..etc) and see if you can see where its comeing from. I would really recoment that you NOT delete these files (there is a reason but I cant rembemer) Embarassed I think it will give you some kinda bad error.
Back to top
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger
ShaolinTiger
Forum Fanatic
Forum Fanatic


Joined: 18 Apr 2002
Posts: 16777215
Location: Kuala Lumpur, Malaysia

Offline

PostPosted: Fri Jan 24, 2003 12:57 pm    Post subject: Reply with quote

Well I just did echo "" > /var/log/lastlog

And it doesn't seem to have broken.

It just shows no logins now.
Back to top
View user's profile Send private message Visit poster's website
squidly
Trusted SF Member
Trusted SF Member


Joined: 07 Oct 2002
Posts: 16777215
Location: Umm.. I dont know.. somewhere

Offline

PostPosted: Sat Jan 25, 2003 1:24 am    Post subject: Reply with quote

Ok I guess I was wrong about the bad things happening..

Oops. Embarassed There is one thing that will give this error "You dont exist go away"
Back to top
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger
Mike
Just Arrived
Just Arrived


Joined: 05 Jan 2003
Posts: 0


Offline

PostPosted: Tue Feb 11, 2003 6:05 pm    Post subject: Reply with quote

or just do

ssh localhost


Wink
Back to top
View user's profile Send private message Send e-mail MSN Messenger
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> UNIX // GNU/Linux All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register