Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Any ideas how to do all above? I've disabled LOG_OK_LOGINS and SYSLOG_SU_ENAB in login.defs, but still don't know how to do everything else.

share|improve this question

According to man wtmp, you cannot disable utmp on Linux:

Unlike various other systems, where utmp logging can be disabled by removing the file, utmp must always exist on Linux. If you want to disable who(1) then do not make utmp world readable.

About the sshd ip logging, you can comment the line begin with auth, authpriv facility in /etc/syslog.conf:

#authpriv.*                      /var/log/secure

and restart the syslog daemon:

# /etc/init.d/syslog start
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

PS: Could you please tell us the reason you want to do that?

share|improve this answer
i did a dirty hack: rm /var/log/wtmp && ln -s /dev/null /var/log/wtmp. seems to be working – Daniel Aug 31 '11 at 8:45
why i need that: total anonimization of people logging into the server – Daniel Aug 31 '11 at 8:51
Anonymization? What do you mean? – quanta Aug 31 '11 at 9:03
in case if server will be hacked attacker shouldn't find out where did i login from – Daniel Aug 31 '11 at 12:51
thats a totally valid point. e.g. the darkleech toolkit, that infects apache >= 2.2.2, checks utmp in order to avoid showing malicious iframes to the admin, so it goes unnoticed. – kulpae Apr 5 '13 at 15:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.