How can I remove the ssh last login info?

In ubuntu, it is found in /etc/ssh/sshd_config.

Find the line that says:

PrintLastLog yes

and change to

PrintLastLog no (or add if it doesnt exist)

Don't forget to restart your ssh by writing service ssh restart


In addition to /var/log/lastlog, there are 3 files in /var/run and /var/log: utmp, wtmp and btmp, which hold info about current logins (and additional info), historical and failed logins. See http://en.wikipedia.org/wiki/Utmp for detailed description. You can't edit the files with normal editors, but could erase them.


utmp is normally in /var/run, not /var/log. wtmp and btmp are in /var/log.

ssh is not the only program that writes to these three files. If you delete them, as someone suggested, you will break a lot of programs. They are expected to be there. Change the /etc/ssh/sshd_config file, as Cameron Aziz suggested.

You are not the only process in the shell. You are not using a single-tasking operating system. Getting used to working on a true network operating system was one of the hardest mental shifts I have ever made, right up there with using a mainframe and learning calculus. In practical terms, this means that you should never remove a file unless you know exactly what it does in the system.

In order to get a flavor for just how widely some files are used, take a look at lsof and play around with it. Even lsof only tells you what processes are CURRENTLY using your file, it doesn't give you historical data, so be careful.