From owner-freebsd-questions Wed Nov 11 15:11:24 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id PAA15891 for freebsd-questions-outgoing; Wed, 11 Nov 1998 15:11:24 -0800 (PST) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from sdcc10.ucsd.edu (sdcc10.ucsd.edu [132.239.50.10]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id PAA15881 for ; Wed, 11 Nov 1998 15:11:20 -0800 (PST) (envelope-from crouilla@ucsd.edu) Received: from localhost (crouilla@localhost) by sdcc10.ucsd.edu (8.8.3/8.8.3) with SMTP id PAA12344; Wed, 11 Nov 1998 15:10:59 -0800 (PST) X-Authentication-Warning: sdcc10.ucsd.edu: crouilla owned process doing -bs Date: Wed, 11 Nov 1998 15:10:59 -0800 (PST) From: Chuck Rouillard Reply-To: chuck@ucsd.edu To: Steve Friedrich cc: FreeBSD Questions Subject: Re: wtmp In-Reply-To: <199811111743.MAA02125@laker.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Wed, 11 Nov 1998, you wrote: > On Wed, 11 Nov 1998 09:26:53 -0600, Dave Bodenstab wrote: > > >> > No. I have the file. I just want to remove a record that user XXX > >> > logged in at the time A and logged out at the time B. To pretend that > >> > he never did. > > This sounds like something a *cracker* would want to do. Why is anyone > helping a *cracker* cover his tracks?? > > I realize he may not be a *cracker*, just wanted to point out the > possibility and warn that even if he's not, your solution could be > valuable to a *cracker*. > > This is not without its merits. Even if it *is* being asked by a cracker and we find solutions, its better that we *all* see the solution to better understand the situation(and its possibilities). -Chuck To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message