Hi all, I've hacked in some better logging for what's going on with my logins and utmp/wtmp. Everything seems OK except for u.ut_host. In my case, the actual variable host for this test case is aragon.cheshirelaw.com. This is fine (as my logs show): Mar 5 21:22:47 frodo sshd[10274]: Actual: 983852567 /dev/ttyp0 aragon.cheshirelaw.com However, check out what u.ut_host is logged as: Mar 5 21:22:47 frodo sshd[10274]: wtmp entry: ttyp0 983852567 gtc aragon.cheshirel\^Wf\M-$:0\M-S\M-?\M-_\M-*\^D\^A This whacks w, who, and utmp. all the sizeof's seem ok for my 2.8 release box: Mar 5 21:22:47 frodo sshd[10274]: wtmp: sizeof(u)=36, sizeof(u.ut_host)=16 Mar 5 21:22:47 frodo sshd[10274]: wtmp: sizeof(u.ut_line)=8, sizeof(u.ut_name)=8 Mar 5 21:22:47 frodo sshd[10274]: wtmp: sizeof(u.ut_time)=4 Any ideas? - - - Geoffrey T. Cheshire <gtc (at) cheshirelaw (dot) com> PGP IDs: 0xA898DA75, 0x7B9C0691 (office), 0x43713B0D (RSA)