Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to hide a particular user's login entry from other users who run the last command?

share|improve this question
Can you be more specific? Your question is pretty ambiguous. – Patkos Csaba Jan 17 '12 at 14:09
Are you saying you want to keep the "login entry" out of a particular user's history? What do you mean by "login entry"? When you log into the machine, login doesn't go into your history. – Kevin Jan 17 '12 at 14:10
He means the last command. He wants to be able to edit [uw]tmp or something like that, to hide his tracks. – angus Jan 17 '12 at 14:23
i want to hide or block particular user's logged information from the linux box. – Mughil Jan 17 '12 at 16:52
up vote 3 down vote accepted

The output of last(1) comes from the traditional wtmp file (usually /var/log/wtmp). As you might imagine, this file isn't writeable by ordinary users (on this box, it belongs to root:wtmp).

Traditionally, the getty was responsible for maintaining wtmp, but these days it's PAM, by means of pam_lastlog.so, which also maintains /var/log/lastlog.

If you're the computer's superuser, you can go to /etc/pam.d and comment out the pam_lastlog.so line from wherever it appears in there, as appropriate. On my machine, it's used only in the login file. Of course, if you're the computer's superuser, you can also replace last and lastlog with a wrapper script that does something like last.orig | fgrep -v some_user.

If you're not the computer's superuser, and the site you're on uses this scheme, there's nothing you can do about it. In terms of both legality and permissions, you can't stop the system from logging your logins and logouts.

share|improve this answer
There are, of course, always ways around things, but discussing them is against my religious beliefs. – Alexios Jan 17 '12 at 21:37

The useradd command comes with an -l option not to add the username that you're going to add to the last login log file.

share|improve this answer

you can hide by modifying the last login information file if you have the root privilege account. like


it will show the blank of last log information.

share|improve this answer

ssh you@host /bin/sh -is - at the price of lacking a PTY.

share|improve this answer

A fast solution is to "disable" last for all normal users by chmod o-r /var/log/wtmp.

In this case, you might also be interested in running chmod o-r /var/log/lastlog to disable the lastlog command.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.