From owner-freebsd-bugs@FreeBSD.ORG Mon Nov 12 19:10:02 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BEB7616A418 for ; Mon, 12 Nov 2007 19:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id AE53A13C48E for ; Mon, 12 Nov 2007 19:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id lACJA2cU018046 for ; Mon, 12 Nov 2007 19:10:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id lACJA2aI018039; Mon, 12 Nov 2007 19:10:02 GMT (envelope-from gnats) Date: Mon, 12 Nov 2007 19:10:02 GMT Message-Id: <200711121910.lACJA2aI018039@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Bob Van Zant Cc: Subject: Re: bin/117773: 'w -n' still dispalys names for IPv6 connections X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Bob Van Zant List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Nov 2007 19:10:02 -0000 The following reply was made to PR bin/117773; it has been noted by GNATS. From: Bob Van Zant To: bug-followup@FreeBSD.org, petefrench@ticketswitch.com Cc: Subject: Re: bin/117773: 'w -n' still dispalys names for IPv6 connections Date: Tue, 13 Nov 2007 00:18:03 +0530 I did manage to repro this and have found that what's in /var/run/utmp contains the hostname of the connected host, not the IP (or IPv6) address. I think pam_lastlog is what keeps utmp current and this comes from pam_lastlog.c::pam_sm_open_session(). The IP address that should be written comes in via pam_handle_t. It appears that pam_lastlog.c simply dumps whatever comes in for PAM_RHOST. Digging down into openpam we see that PAM_RHOST is "The name of the applicant's host." Falling back up into OpenSSH's auth-pam.c we see that it sets PAM_RHOST to the remote name or IP (get_remote_name_or_ip()). So this sets up pam_lastlog to log the hostname if it knows it and only if it can't find the reverse name it logs the IP. The gist of this is, quite simply, that what's in /var/run/utmp is correct. It is supposed to be the hostname, if known and otherwise the IP address. w(1) -n does exactly what it's supposed to: it does "not attempt to resolve network addresses." So rest assured that no reverse DNS queries are being done even though hostnames are showing up. All of that said I believe this bug can be closed without doing any work. -Bob