Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to remove any and all activity logs for SSH remotely. How do I get to it?

My account on the remote server doesn't have admin privilege, and as such I just want to remove user to user connection records.

share|improve this question
This sounds suspicious. :) – Richard Holloway Aug 18 '11 at 12:28
@Richard, sure it does, but what sounds more suspicious is deleting everything as opposed to just deleting the current session's data. – Oxwivi Aug 18 '11 at 14:33
regarding update: not going to happen. If the admin is worth his salt all logs are world-readable but not editable by any one other than the admin (ie. root or sudo permissions required). – Rinzwind Aug 18 '11 at 14:45
@Rinzwind, nothing is saved in the user directory itself? In the .ssh directory or something, for example. – Oxwivi Aug 18 '11 at 14:47
The commands you issued when you have access will be in your bash history file. That's about all I can think of. – Rinzwind Aug 18 '11 at 14:53
up vote 11 down vote accepted

The answer to this lies in sshd.conf and sshd_config (server) and ssh_config (client). Depending on the log level it logs to /var/log/syslog (default) and/or /var/log/auth.log (loglevel 'verbose' contains ssh login attempts).

If present /var/log/secure also contains an access log.

You will need root/sudo access to edit any of these files: they will be word-readable but not world-editable.

Next to that. Besides the login from the ssh daemon the command last also shows (failed) logins from ssh. The information for this command comes from /var/log/wtmp (There will be several more I bet).

And there is also the probability the sysadmin installed auditd or logwatch making it practically impossible to hide activity since they could get a notice based on activity undoing the registration of the ssh activity impossible.

Example of /var/log/auth.log:

Aug 10 10:10:10 rinzwind sshd[3653]: Invalid user text from {ipadress}
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp
Aug 10 10:10:10 rinzwind sshd[3653]: error: Could not get shadow information for NOUSER
Aug 10 10:10:10 rinzwind sshd[3653]: Failed password for invalid user test from {ipadress} port {port} ssh2
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp
share|improve this answer
Updated question. – Oxwivi Aug 18 '11 at 14:43
By the way, just what kind of data is logged when SSH connection takes place? IP address for sure, but what else? – Oxwivi Aug 18 '11 at 14:44
No username recorded? – Oxwivi Aug 18 '11 at 15:29

You would want to look at /var/log/messages and/or /var/log/syslog.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.