Like the following answer Bash command to determine first login for a particular time period, instead of for a duration I want to find out to check is the first time the user connected into machine using ssh.
Is it possible to find out it a specific user?
This line should print "First" if it's the first login by user "user" since reboot from non-local host:
[ $( last | sed '/^reboot/,$d' | egrep '^user +pts/' | wc -l ) -lt 2 ] && echo First
Note that the last log is usually rotated monthly, so the answer might be incorrect if the user has logged in more than one month ago.
I anchor the expression with ^ to make sure the user name is picked from the first column (should the user's name be still, we'd get a false hit on lines reading still logged in :-) and I also expect pts/ to appear, indicating a remote login (local logins are indicated with tty instead).
This should work even if the computer hasn't been rebooted current month. But it would not work if your user's login name is verbatim reboot.
user above with the login name of the user you wish to check. If you want a more generic solution replace user with either '$(whoami)' or '$LOGNAME' including the apostrophes. If you still feel it doesn't work, could you please provide the output from your last command (replace real names with fake names for security reasons but be consequent).