Linux – why /var/log/wtmp and /var/log/lastlog have read permission for other users

linuxunix

In my Linux server lastlog and wtmp files have read permission set for other users (664) . Do we really need to keep the read permission for other users or can I change it to (660 or 640) . Does it affect anything in the server like some command execution and all ?

Best Answer

Since those files contain a record of who logged in and from where they are needed if want tools like last , who and w etc. to work.

AFAIK those files also contain the info that some login shells display
"last login from user NAME was on DATE-TIME from IP/host"
which is a useful security feature that allows users to monitor their own account for abuse.

I would keep the permissions on wtmp and lastlog as they are.