Hi, sorry for replying to my own posting, but of course it should read * /var/log/lastlog not world readable instead of > * /var/log/wtmp not world readable Cheers, Thomas