如何禁用写入/ var / log / lastlog

Question

how do i disable writing to /var/log/lastlog file. In our system we had to use a vfat file system for /var/log and since it doesn't support sparse files, our lastlog file gets real huge. I'm tried 'session required pam_lastlog.so noupdate' as last rule in /etc/pam.d/login but it doesn't seem to be working.

having 'LASTLOG_ENAB no' in /etc/login.defs isn't also working.

Appreciate any help. Don't get any hits for this on web.

Answer 1

First, the answer: There are a number of ways to do it.

1. Make the file immutable with chattr. Zero it's size first. Now nobody is allowed to write to it.
2. ln -s it to /dev/null. Writes will still be allowed, but they go off into never-never land.
3. Delete it and create a directory with the same name.
4. Delete it and see if your version of the logging system will recreate it, several of them won't.

Obligatory warnings:
1) Removing lastlog disrupts the audit-trail on your system and may cause various security tools to fail to function properly, or at all.

2) vfat does not support sparse files... It also does not support journaling or individual file ownership. By putting /var/log on vfat you are making it much, much easier for crackers (or even power failures) to potentially alter, damage, or destroy your logfiles. There are lots of better filesystems out there, you should probably find one. But that would be a separate question.