search for: btmp

IN the /var/log/ folder there are two files WTMP and BTMP BTMP is getting huge after a year, about 800MB, WTMP is getting close to 1MB. In the /etc/logrotate.conf I see this -------------------- # no packages own wtmp -- we'll rotate them here /var/log/wtmp { monthly minsize 1M create 0664 root utmp rotate 1 } ------------------- I...

Hi, Openssh doesn't log failed logins to /var/log/btmp like login does (if btmp exists). This is on RH6.2. Is there a specific reason for not logging to btmp ? I think that logging to btmp would be a 'good thing'(tm). What about other unices ? Do they have /var/log/btmp or something similar (AIX has something like that and I think openssh...

a while back i reported an issue where /dev/null was getting set to 600 perms after a system update. i finally figured out what it is. i don't care about failed logins and have limited space on some servers, so i symlinked /var/log/btmp to /dev/null. the initscripts package does a chmod 600 /var/log/btmp, so voila /dev/null gets changed. so now i know why it happened just to me. i now need to figure out a better way to deal with btmp. any ideas from the list?

...ent : Record |Record Badlogins for all |Badlogins for all supported |supported Authentication |Authentication methods |methods ------- Additional Comments From dtucker at zip.com.au 2005-01-20 16:58 ------- Redhat (and maybe Solaris?) also have btmp, so setting platform to "All". Just so it's clear: the btmp code in loginrec is derived from login from util-linux correct? If so that's BSD licensed (w/advertising clause) with UCB as the copyright holder. Since UCB rescinded the advertising clause I think we're OK to use...

...have been using Splus to analyze an ongoing series of datasets that have a bimodal distribution. I have used the following functions, in particular the ms() function, to estimate the parameters: two means, two standard deviations, and one proportion. Here is the code I've been using in S: btmp.bi <- function(vec, p, m1, m2, sd1, sd2) { (exp(p)/(1+exp(p)))*dnorm(vec,mean=m1,sd=abs(sd1))+ (1-(exp(p)/(1+exp(p))))*dnorm(vec,mean=m2,sd=abs(sd2)) } btmp11 <- ms( ~ - sum(log((btmp.bi(btmp1$Temp, p, m1, m2, s1, s2)))), start = list(p = 0.4, m1...

...f (bs != 0) > abort (); > } > /******************************************************************Source > Code > End*******************************************************************/ > What clang is generating can be approximated by the following pseudocode: atmp1, atmp2, btmp = alloca space for temporaries call a::a on atmp1 try { call a::a on atmp2 try { call f(atmp1, atmp2) call b::b on btmp } catch { } finally { call a::~a on atmp2 } } catch { } finally { call a::~a on atmp1 } // NOW b is "constructed" Looking at the output...

...n logrotate ran for the first time such that /var/lib/logrotate.status has: logrotate state -- version 2 "/var/log/yum.log" 1970-1-1-0:0:0 "/var/log/wtmp" 1970-1-1-0:0:0 "/var/log/chrony/*.log" 1970-1-1-0:0:0 "/var/log/spooler" 1970-1-1-0:0:0 "/var/log/btmp" 1970-1-1-0:0:0 "/var/log/maillog" 1970-1-1-0:0:0 "/var/log/wpa_supplicant.log" 1970-1-1-0:0:0 "/var/log/secure" 1970-1-1-0:0:0 "/var/log/ppp/connect-errors" 1970-1-1-0:0:0 "/var/log/messages" 1970-1-1-0:0:0 "/var/log/cron" 1970-1-1-0...

...Platform: HPPA OS/Version: All Status: NEW Severity: normal Priority: P2 Component: Miscellaneous AssignedTo: openssh-bugs at mindrot.org ReportedBy: ashok_kovai at hotmail.com OpenSSH doesn't record badlogin attempts in btmp file for all possible authentication methods supported ( given below ). This patch is an enhancement to support this feature. Authentication Methods Supported --------------------------------- "gssapi-with-mic" "publickey" "hostbased" "password" "key...

...47]: debug1: userauth-request for user alice$ service ssh-connection method none [preauth] May 25 13:43:44 alice sshd[29647]: debug1: attempt 0 failures 0 [preauth] May 25 13:43:44 alice sshd[29647]: Invalid user alice$ from 192.168.24.3 May 25 13:43:44 alice sshd[29647]: debug1: Unable to open the btmp file /var/log/btmp: No such file or directory May 25 13:43:44 alice sshd[29647]: input_userauth_request: invalid user alice$ [preauth] May 25 13:43:44 alice sshd[29647]: debug1: PAM: initializing for "alice$" May 25 13:43:44 alice sshd[29647]: debug1: PAM: setting PAM_RHOST to "bob.s...

Dear LLVM Members, The below source code from gcc test suite replicates the problem which i am facing. When it is built with clang, it throws an abort (highlighted). The following are my observations - 1. The object(tmp) is not getting destroyed immediately after the exception is thrown. In case of Clang, the object is getting destroyed at a later point of time. 2. In case of gcc, the

....log" 1969-12-31-20:26:1 "/var/named/data/named.run" 1969-12-31-20:26:1 "/var/log/httpd/error_log" 2015-8-27-4:43:1 "/var/log/wtmp" 1969-12-31-20:26:1 "/var/log/chrony/*.log" 2015-8-19-22:0:0 "/var/log/spooler" 1969-12-31-20:26:1 "/var/log/btmp" 1969-12-31-20:26:1 "/var/log/maillog" 1969-12-31-20:26:1 "/var/log/wpa_supplicant.log" 2015-8-19-22:0:0 "/var/log/secure" 1969-12-31-20:26:1 "/var/log/ppp/connect-errors" 2015-8-19-22:0:0 "/var/log/messages" 1969-12-31-20:26:1 "/var/log/c...

The following alteration needs to be made to loginrec.c in the routine record_failed_login() #ifdef USE_UTMP ??????? construct_utmp(&li, &ut); #endif It was missing "#ifdef USE_UTMP" which causes an problem if you are not using UTMP. gt

http://bugzilla.mindrot.org/show_bug.cgi?id=979 Summary: Openssh doesn't support UTMPS/BTMPS/WTMPS database Product: Portable OpenSSH Version: 3.9p1 Platform: Other OS/Version: HP-UX Status: NEW Severity: enhancement Priority: P5 Component: Miscellaneous AssignedTo: openssh-bugs at mindrot.org...

...cron /var/log/maillog /var/log/messages /var/log/secure /var/log/spooler reading config file wpa_supplicant reading config info for /var/log/wpa_supplicant.log reading config file yum reading config info for /var/log/yum.log reading config info for /var/log/wtmp reading config info for /var/log/btmp Handling 22 logs rotating pattern: /var/log/apcupsd.events weekly (4 rotations) empty log files are not rotated, old logs are removed considering log /var/log/apcupsd.events log does not need rotating rotating pattern: /var/log/ConsoleKit/history monthly (6 rotations) empty log files are no...

...enge_start: trying authentication method 'pam' [preauth] Postponed keyboard-interactive for root from 10.10.0.34 port 38327 ssh2 [preauth] PAM: Authentication failure for root from 10.10.0.34 Failed keyboard-interactive/pam for root from 10.10.0.34 port 38327 ssh2 debug1: Unable to open the btmp file /var/log/btmp: No such file or directory debug1: userauth-request for user root service ssh-connection method keyboard-interactive [preauth] debug1: attempt 2 failures 1 [preauth] debug1: keyboard-interactive devs [preauth] debug1: auth2_challenge: user=root devs= [preauth] debug1: kbdint_all...

Hi, I would like to know the significance of trying `none` method during authentication sequence. Is there any way to avoid unnecessary trying of this none authentication method first. We are writing a patch to log bad login into btmp for all traditional authentication methods supported by SSH. The `none` method increments the authctx-failures and we are facing problems with this. -logu

...entries like: Aug 29 02:23:31 otso sshd[21000]: reverse mapping checking getaddrinfo for powered.by.e-leven.be [78.110.207.104] failed - POSSIBLE BREAK-IN ATTEMPT! Aug 29 02:23:31 otso sshd[21000]: Invalid user upload from 78.110.207.104 and these also show as multiple 'lastb' entries in btmp: upload ssh:notty 78.110.207.104 Wed Aug 29 02:23 - 02:23 (00:00) upload ssh:notty 78.110.207.104 Wed Aug 29 02:23 - 02:23 (00:00) upload ssh:notty 78.110.207.104 Wed Aug 29 02:23 - 02:23 (00:00) upload ssh:notty 78.110.207.104 Wed Aug 29 02:23 - 02:23 (00:00) uploa...

...a specific setting just for maillog (since that file gets huge really quick) would I add 1- a new file /etc/logrotate.d/maillog with the parameters just like the other files 2- add parameters in the file it is already located in (/etc/log...d/syslog) 3- logrotate.conf where other settings for btmp and wtmp are located. Which is the 'best practice' or preferred solution to changing the defaults for the files in the logrotate.d/syslog file. Right now I have changed logrotate.conf to go off daily to keep the maillog from getting to huge. I do not know what the default is for size f...

Hello All, We have a sensitive network where users authenticates through SSH. We support multiple authentications with respective to their groups . As a security concern we continue to monitor failed or bad login attempts of every user using lastb command, but SSH never logs the bad login attempts of the user like telnet does . We would like to have this feature on SSH for every supported

...root adm 9508 Jun 5 06:47 auth.log.2.gz -rw-r----- 1 root adm 12475 May 29 06:47 auth.log.3.gz -rw-r--r-- 1 root root 9838 May 3 17:43 base-config.log.1 -rw-r--r-- 1 root root 384 May 3 17:43 base-config.timings.1 -rw-rw-r-- 1 root utmp 0 Jun 1 06:25 btmp -rw-rw-r-- 1 root utmp 384 May 22 15:57 btmp.1 drwxr-xr-x 2 clamav clamav 4096 Jun 19 06:25 clamav -rw-r----- 1 root adm 479384 Jun 21 16:15 daemon.log -rw-r----- 1 root adm 2017570 Jun 21 06:24 daemon.log.0 -rw-r----- 1 root adm 57638 Jun 19 06:24 daemon.log.1.gz...