Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any way to hide a particular user's login entry from other users who run the last command?

share|improve this question
    
Can you be more specific? Your question is pretty ambiguous. –  Patkos Csaba Jan 17 '12 at 14:09
    
Are you saying you want to keep the "login entry" out of a particular user's history? What do you mean by "login entry"? When you log into the machine, login doesn't go into your history. –  Kevin Jan 17 '12 at 14:10
    
He means the last command. He wants to be able to edit [uw]tmp or something like that, to hide his tracks. –  angus Jan 17 '12 at 14:23
    
i want to hide or block particular user's logged information from the linux box. –  Mughil Jan 17 '12 at 16:52
add comment

5 Answers 5

up vote 2 down vote accepted

The output of last(1) comes from the traditional wtmp file (usually /var/log/wtmp). As you might imagine, this file isn't writeable by ordinary users (on this box, it belongs to root:wtmp).

Traditionally, the getty was responsible for maintaining wtmp, but these days it's PAM, by means of pam_lastlog.so, which also maintains /var/log/lastlog.

If you're the computer's superuser, you can go to /etc/pam.d and comment out the pam_lastlog.so line from wherever it appears in there, as appropriate. On my machine, it's used only in the login file. Of course, if you're the computer's superuser, you can also replace last and lastlog with a wrapper script that does something like last.orig | fgrep -v some_user.

If you're not the computer's superuser, and the site you're on uses this scheme, there's nothing you can do about it. In terms of both legality and permissions, you can't stop the system from logging your logins and logouts.

share|improve this answer
    
There are, of course, always ways around things, but discussing them is against my religious beliefs. –  Alexios Jan 17 '12 at 21:37
add comment

The useradd command comes with an -l option not to add the username that you're going to add to the last login log file.

share|improve this answer
add comment

you can hide by modifying the last login information file if you have the root privilege account. like

/var/log/wtmp

it will show the blank of last log information.

share|improve this answer
add comment

ssh you@host /bin/sh -is - at the price of lacking a PTY.

share|improve this answer
add comment

A fast solution is to "disable" last for all normal users by chmod o-r /var/log/wtmp.

In this case, you might also be interested in running chmod o-r /var/log/lastlog to disable the lastlog command.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.