Could it be possible for a user that logined in the machine and not
showed from the "last" command?  Or  could it possible for a user to
get rid of his login id showing from "last" command"?  I mean could it
possible to modify the "last"  command's log? 

Thanks for advice.

In article <1150599799.410941.216410@f6g2000cwb.googlegroups.com>,
 tim_batiees@hotmail.com wrote:

> Could it be possible for a user that logined in the machine and not
> showed from the "last" command?  Or  could it possible for a user to
> get rid of his login id showing from "last" command"?  I mean could it
> possible to modify the "last"  command's log? 
> 
> Thanks for advice.

You'd have to have root and write a C program to do it.  The format of 
the file is known, so this isn't that farfetched.  If an intruder has 
root on your machine, I'd imagine this would be one of the things they'd 
do to cover it up.  There must be root kits out there you can study.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...

Yes, if you knew what you were doing you could modify /var/adm/wtmpx.

Also, you can run commands via ssh without triggering a wtmpx entry.

Example:

ssh <hostname> "command"