wtmp 파일 조작

/var/log/wtmp 파일을 조작하여 삭제할 부분만 삭제하기

 

로그 확인

# last -f /var/log/wtmp
ken      pts/0        192.168.3.69     Wed Feb 15 09:00   still logged in
ken      pts/1        192.168.3.69     Fri Feb 10 11:41 - 11:47  (00:05)
ken      pts/0        192.168.3.69     Fri Feb 10 07:45 - 20:10  (12:25)
reboot   system boot  4.2.0-16-generic Thu Feb  9 08:33   still running
ken      pts/1        192.168.3.69     Mon Feb  6 10:23 - down  (2+09:49)
ken      pts/0        192.168.3.69     Mon Feb  6 10:15 - 18:59 (2+08:43)
ken      tty1                          Mon Feb  6 10:08 - 10:22  (00:14)    ---> 삭제 대상
reboot   system boot  4.2.0-16-generic Mon Feb  6 10:07 - 20:13 (2+10:05)

wtmp begins Mon Feb  6 10:07:23 2017

 

tty1 또는 192.168.0.2 구문이 포함된 라인 삭제.

# utmpdump /var/log/wtmp | grep -v "tty1" > temp.txt
또는
# utmpdump /var/log/wtmp | grep -v "192.168.0.2" > temp.txt

# utmpdump -r < temp.txt > /var/log/wtmp
# rm -f temp.txt # Use 'shred' if it is installed

 

tty1 가 포함된 라인만 삭제되었다.

# last -f /var/log/wtmp
ken      pts/0        192.168.3.69     Wed Feb 15 09:00   still logged in
ken      pts/1        192.168.3.69     Fri Feb 10 11:41 - 11:47  (00:05)
ken      pts/0        192.168.3.69     Fri Feb 10 07:45 - 20:10  (12:25)
reboot   system boot  4.2.0-16-generic Thu Feb  9 08:33   still running
ken      pts/1        192.168.3.69     Mon Feb  6 10:23 - down  (2+09:49)
ken      pts/0        192.168.3.69     Mon Feb  6 10:15 - 18:59 (2+08:43)
reboot   system boot  4.2.0-16-generic Mon Feb  6 10:07 - 20:13 (2+10:05)

wtmp begins Mon Feb  6 10:07:23 2017

last 명령을 실행해서 확인되는 내용도 동일하다.