In my Linux server lastlog and wtmp files have read permission set for other users (664) . Do we really need to keep the read permission for other users or can I change it to (660 or 640) . Does it affect anything in the server like some command execution and all ?
In one of the server even though lastlog is with 000 (wtmp with 664) , Commands like last,who are working for non-root user .
For the file /var/log/wtmp, the read and write permission for the group utmp is to allow it to write the login, logout informations to the file. Changing it to readonly for group will affect this process.
And the read access for others is to read the file on executing commands like last, who which are dependent on wtmp log. If this read is revoked, these commands will throw Permission Denied errors unless executed by root or sudo user.
/var/log/lastlog is used for lastlog command, modifying the permissions of this file will lead to similar errors for lastlog command only.
There is no private information in such files, and I find useful to find which user are logged and when they logged in my machines (active users), e.g. before to make a reboot.
I could construct the same information (less precise) looking for processes (think about top or ps). Just the IP address is not there, but possibly users can discover it anyway.
