Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -1 down vote favorite

Any ideas how to do all above? I've disabled LOG_OK_LOGINS and SYSLOG_SU_ENAB in login.defs, but still don't know how to do everything else.

share|improve this question

1 Answer

up vote 1 down vote

According to man wtmp, you cannot disable utmp on Linux:

Unlike various other systems, where utmp logging can be disabled by removing the file, utmp must always exist on Linux. If you want to disable who(1) then do not make utmp world readable.

About the sshd ip logging, you can comment the line begin with auth, authpriv facility in /etc/syslog.conf:

#authpriv.*                      /var/log/secure

and restart the syslog daemon:

# /etc/init.d/syslog start
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

PS: Could you please tell us the reason you want to do that?

share|improve this answer
1  
i did a dirty hack: rm /var/log/wtmp && ln -s /dev/null /var/log/wtmp. seems to be working – Daniel Aug 31 '11 at 8:45
why i need that: total anonimization of people logging into the server – Daniel Aug 31 '11 at 8:51
Anonymization? What do you mean? – quanta Aug 31 '11 at 9:03
1  
in case if server will be hacked attacker shouldn't find out where did i login from – Daniel Aug 31 '11 at 12:51
thats a totally valid point. e.g. the darkleech toolkit, that infects apache >= 2.2.2, checks utmp in order to avoid showing malicious iframes to the admin, so it goes unnoticed. – kulpae Apr 5 at 15:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.