From owner-freebsd-security@FreeBSD.ORG Tue Jan 27 15:49:33 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9A11316A4CE for ; Tue, 27 Jan 2004 15:49:33 -0800 (PST) Received: from phuket.psconsult.nl (ps226.psconsult.nl [213.222.19.226]) by mx1.FreeBSD.org (Postfix) with ESMTP id B06BF43D41 for ; Tue, 27 Jan 2004 15:49:28 -0800 (PST) (envelope-from paul@phuket.psconsult.nl) Received: from phuket.psconsult.nl (localhost [127.0.0.1]) by phuket.psconsult.nl (8.12.6p3/8.12.6) with ESMTP id i0RNnRGB027668 for ; Wed, 28 Jan 2004 00:49:27 +0100 (CET) (envelope-from paul@phuket.psconsult.nl) Received: (from paul@localhost) by phuket.psconsult.nl (8.12.6p3/8.12.6/Submit) id i0RNnQDL027667 for freebsd-security@freebsd.org; Wed, 28 Jan 2004 00:49:26 +0100 (CET) Date: Wed, 28 Jan 2004 00:49:26 +0100 From: Paul Schenkeveld To: security at FreeBSD Message-ID: <20040127234926.GA27135@psconsult.nl> Mail-Followup-To: security at FreeBSD References: <20040127210015.GA12328@pc5.i.0x5.de> <014f01c3e51a$a5a302e0$3501a8c0@peter> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <014f01c3e51a$a5a302e0$3501a8c0@peter> User-Agent: Mutt/1.5.4i Subject: Re: Possible compromise ? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Jan 2004 23:49:33 -0000 Hi Peter, On Tue, Jan 27, 2004 at 10:15:10PM +0100, Peter Rosa wrote: > > Thanks for pointing me. But lastlogin returns only local and only few last > connects. > If I understand well, the bottom of lastlogin is the oldest. So may be, that > connections was done in the deep past. Every login gets logged to wtmp, but wtmp gets rotated by newsyslog. BTW, oldest logins are at the top of the file but the last(1) command reads the file backwards for convenience. /var/log/astlog holds one record for every user that ever logged in into the system with the time and date, tty line and remote host of that last login. It never gets truncated so that's why it's normal to see entries for ttyp0 and ttyp1 there even if these ttys have been disabled afterwards. I know of no standard program to list the entire lastlogin file (/bin/login only shows your own record when logging in) so I've thrown a few bytes in the right order to visualize its contents. Just compile is with "cc -o showlast showlast.c" There's a uuencoded copy of the source at the end jus in case your mailer scrambles the listing. Regards, Paul Schenkeveld, Consultant PSconsult ICT Services BV /* showlast.c - show contents of lastlog */ #include #include #include #include #include #define LASTLOG "/var/log/lastlog" int main(int argc, char *argv[]) { struct lastlog lbuf; struct passwd *pw; int fd, n; uid_t uid = 0; if ((fd = open(LASTLOG, O_RDONLY)) < 0) { perror(LASTLOG); exit(1); } printf("Username UID Line Remote host Date/time\n"); printf("---------------- ----- -------- ---------------- " "------------------------\n"); while ((n = read(fd, &lbuf, sizeof(lbuf))) == sizeof(lbuf)) { if (lbuf.ll_time > 0) { pw = getpwuid(uid); printf("%-16.16s %5d %-*.*s %-*.*s %s", pw ? pw->pw_name : "(unknown)", uid, UT_LINESIZE, UT_LINESIZE, lbuf.ll_line, UT_HOSTSIZE, UT_HOSTSIZE, lbuf.ll_host, ctime(&lbuf.ll_time)); } uid++; } close(fd); switch (n) { case -1: perror(LASTLOG); exit(1); case 0: break; default: fprintf(stderr, "%s: corrupted\n", LASTLOG); exit(1); } exit(0); } begin 644 showlast.c M+RH@7!EPH)<&5R