search for: wtmp

Hi all! wtmp entries are generated when loggin into a system without a command, e.g. "ssh -l user system". When using an additional command executed by ssh on the "other side", no wtmp entry will be generated. So the command "ssh -l user system /bin/csh" will not generate a wtmp en...

I've noticed rather strange wtmp logging behavior in sshd. Can anyone confirm or solve the following: Once a user authenticates themself to sshd, sshd among other things records the login in the wtmp, which `last` reads. However, sshd logs hostnames which are longer than 16 characters instead of IPs like normal programs would...

hi, from reiserfs it`s known to happen quite often - wtmp may be corrupted; but actually I`m using only ext2/3 on the test machine. After 7 days running the RH8 system I`ve noticed the first corruption of wtmp. last shows only the line wtmp begins Wed Dec 11 09:14:52 2002 and /usr/sbin/dump-utmp wtmp spits out the history, e.g. the last line |Sun Dec 15...

...tatus: NEW Severity: security Priority: P1 Component: ssh AssignedTo: openssh-bugs at mindrot.org ReportedBy: micah at cs.swt.edu problem: whenever you startup a ssh session with a graphical ssh client, fork a sftp session, and exit the ssh session the wtmp log indicates the user has logged out even though they still have an open sftp session. reproducibility: always workaround: startup a sftp session first, then fork a ssh session. I believe this bug is related to "session_destroy_all(NULL);" in "server_loop2(Authctxt *authctxt)&quo...

There are conflicting reports about wether or not Red Hat 4.0 is vulnerable to the login-lockout described earlier. I have the impression that if you install the updates it will have been fixed. Approval of messages about this subject is now restricted to "here is a patch", and a vendors "We have made a patch available". Roger.

I spent some time with 3.0.2p1 to discover why OpenSSH on HP/UX 11.00 64-bit corrupts the /var/adm/wtmp file. The problem is with the utmp structure itself. When building with 32-bit compilation flags, the size of the utmp structure is 60 bytes. When building under 64-bit, the size is 72 bytes. The size difference is due to structure alignment and using basic types whose size changes depending on...

https://bugzilla.mindrot.org/show_bug.cgi?id=1946 Bug #: 1946 Summary: AIX and /var/adm/wtmp Classification: Unclassified Product: Portable OpenSSH Version: 5.9p1 Platform: PPC OS/Version: AIX Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: unassigned-bugs at mindrot.org...

...surprisingly, this has meant looking at some old code.. The following denial of service attack seems to work quite nicely on my ancient Red Hat 3.0.3 system with the standard login application. Perhaps this is not a problem with 4.0? Does anyone know about other distributions? joe$ nvi /var/log/wtmp [ Now no-one else can log in ] This is a problem with advisory locking. The fact that anyone can create an exclusive lock on a file they can only read! Is this behavior appropriate? My copy of the POSIX book (D. Lewin, O''Reilly & Assoc. ''94) is a little vague as to the &qu...

http://bugzilla.mindrot.org/show_bug.cgi?id=1030 Summary: sshd writes twice to wtmp when "UseLogin" is yes Product: Portable OpenSSH Version: 4.0p1 Platform: HPPA OS/Version: HP-UX Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: openssh-bugs at mindrot.org...

...rlos Mendes Luis <jonny@coe.ufrj.br> wrote: > I think it would be useful if samba had a utmp log interface. > I know that it's possible to see who is logged with smbstatus, but > sometimes a simple who(1) or w(1) is more efficient and ubiquitous. If you were to search for 'wtmp' in the 1997 archives (via the Samba web pages), you would find one interesting posting: http://samba.anu.edu.au/samba/digest/1997/97oct/0175.html This posting describes using "sessreg" to log to utmp/wtmp. sessreg is affiliated with xdm--it logs to utmp/wtmp as part for users...

...the /usr/bin/login program on SGI Irix, (we are using Irix version 6.5.13). I do this because the SGI login program is AFS awhere and checks out a token for you and I do not want to compile the Kerberos version of sshd, (it is to messy for me to support). Everything seems to work fine accept the wtmp(x) and utmp(x) files do not get updated? The problem existed in openssh 3.0.2 I just upgraded to 3.4 and still have the problem. Here is what I have found, if anyone has any info that would be great else I will have to live with this: The login program is execl'd in the sesssion.c file using...

...996, Andrew G. Morgan wrote: > The following denial of service attack seems to work quite nicely on my > ancient Red Hat 3.0.3 system with the standard login application. Perhaps > this is not a problem with 4.0? Does anyone know about other distributions? > > joe$ nvi /var/log/wtmp > > [ Now no-one else can log in ] Now that we''ve determined that this problem exists in just about every popular, current distribution, what can I do or where do I go for my best bet at a (temporary, at least) solution? Any additional information on what is/isn''t fi...

http://bugzilla.mindrot.org/show_bug.cgi?id=1029 Summary: SIGTERM and cleanup of wtmp files Product: Portable OpenSSH Version: 4.0p1 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: openssh-bugs at mindrot.org ReportedBy: senthilkumar_se...

Hello, I recently switched from SSH-1.2.27 to OpenSSH-1.2.2 and I found this bug: OpenSSH-1.2.2 (SSH-1.5-OpenSSH-1.2.2) does not update the wtmp file. Software: Linux/Unix port of OpenSSH version 1.2.2 OS: Linux Slackware 3.6 & 4.0 (x86) Problem: When logging in/out via sshd there is no update to the wtmp file -- Victor Meghesan

Hi :-) i have rollout a new ssh pakage in our environment. Apr 27 12:06:03 systemx sshd[869]: [ID 847 auth.info] wtmp_write: problem writing /var/adm/wtmp: No such file or directory Solaris 8 has no /var/adm/wtmp, it use /var/adm/wtmpx In the old package there was many of this messages I compiled the new package with --disable-wtmp \ --enable-wtmpx \ but sometimes one of this message are in the auth.. Frank

...ction when privilege separation is enabled, 3 processes are of interest for this topic. 1. sshd:[priv] - privileged user process. 2. sshd:user at pts/0 - user process. 3. shell - shell process. Openssh code writes the #2. sshd:user at pts/0 - user process to the utmp/wtmp file. Is this the correct behaviour.? Or should it write the #3. shell pid to the utmp/wtmp file. Thanks -logu

Please carbon-copy me on replies. For some reason, my wtmp is never updated when I login via openssh. Some information about my system: Linux kernel 2.6.9 running glibc-2.3.4. And the opensshd is openssh-3.9p1 (pkgsrc package openssh-3.9.1nb6). $ ls -l /var/log/lastlog /var/log/wtmp /var/run/utmp -rw-rw-r-- 1 root utmp 29492 May 25 13:12 /...

...ally undefining HAVE_DEV_PTMX like this: /* Pty allocated with _getpty gets broken if we do I_PUSH:es to it. */ #if defined(HAVE__GETPTY) || defined(HAVE_OPENPTY) #undef HAVE_DEV_PTMX #endif #undef HAVE_DEV_PTMX Then everything compiles, installs and functions ALMOST normally. However, /var/log/wtmp is NOT updated. Login messages appear in syslog quite normally, /var/run/utmp appears to be updated properly, but /var/log/wtmp is not updated on login/logpout using openSSH. I also note that, on the same setup, /var/log/wtmp IS updated correctly when using commercial SSH (version 1.2.26). Any...

...Sat Aug 1 20:52 - 20:52 (00:00) > xF*@**** otify ***@ Sat Aug 1 20:52 - 20:52 (00:00) > xF*@**** otify ***@ Sat Aug 1 20:52 - 20:52 (00:00) > Thanks to all who replied. The culprit seems to have been incompatibilities in utmp/wtmp between glibc and libc-5, and not the result of a hacker invading my system. Many sent similar responses, so I am forwarding just a few of those which were different from each other. -sen ******************* From: "Charles R. Anderson" <cra@WPI.EDU> This is the result of a b...

Hi, On Linux, glibc is using a 32bit time_t for wtmp and similar structs even on a 64bit system: https://www.thkukuk.de/blog/Y2038_glibc_utmp_64bit/ https://www.thkukuk.de/blog/Y2038_glibc_wtmp_64bit/ Since the glibc developers stated that they don't plan to solve the problem in glibc, but think that this interfaces are legacy and should be rem...