From owner-freebsd-security Sat Jul 7 18:44:28 2001 Delivered-To: freebsd-security@freebsd.org Received: from avocet.mail.pas.earthlink.net (avocet.mail.pas.earthlink.net [207.217.121.50]) by hub.freebsd.org (Postfix) with ESMTP id 6C79C37B420 for ; Sat, 7 Jul 2001 18:44:24 -0700 (PDT) (envelope-from cjc@earthlink.net) Received: from blossom.cjclark.org (dialup-209.244.106.149.Dial1.SanJose1.Level3.net [209.244.106.149]) by avocet.mail.pas.earthlink.net (EL-8_9_3_3/8.9.3) with ESMTP id SAA22925; Sat, 7 Jul 2001 18:44:16 -0700 (PDT) Received: (from cjc@localhost) by blossom.cjclark.org (8.11.4/8.11.3) id f681iF009555; Sat, 7 Jul 2001 18:44:15 -0700 (PDT) (envelope-from cjc) Date: Sat, 7 Jul 2001 18:44:14 -0700 From: "Crist J. Clark" To: Igor Roshchin Cc: security@FreeBSD.ORG Subject: Re: wtmp corrupted - ? Message-ID: <20010707184414.H408@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <200107072220.f67MKJ613641@giganda.komkon.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200107072220.f67MKJ613641@giganda.komkon.org>; from str@giganda.komkon.org on Sat, Jul 07, 2001 at 06:20:19PM -0400 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Sat, Jul 07, 2001 at 06:20:19PM -0400, Igor Roshchin wrote: > > Hello! > > I've just found that my wtmp file is corrupted. > (See the output of last(1) below). > Is this a bug or is it a sign of somebody trying to clear his trace ? > (This is on 4.3-RELEASE). > > Are there any tools around which allow to easily read a corrupted wtmp ? I had this problem on a Solaris box. A poorly written app would not log people off properly and eventually consume all ttys. People could then not log in. The admin of the box discovered that if she, # cp /dev/null /var/adm/wtmp It would "fix" the problem, and people could get in. *Grrr* Anyway I ended up with some damaged files. I built a quick C program to read the file and then just used head(1) and tail(1) to recover what was recoverable. The contents of a wtmp file are simple and defined in wtmp(5) (just cut and paste). It would also be pretty easy to write a Perl script to do it. Sorry, I don't have the little program with me at the moment. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message