decoration decoration
Stories

GROKLAW
When you want to know more...
decoration
For layout only
Home
Archives
Site Map
Search
About Groklaw
Awards
Legal Research
Timelines
ApplevSamsung
ApplevSamsung p.2
ArchiveExplorer
Autozone
Bilski
Cases
Cast: Lawyers
Comes v. MS
Contracts/Documents
Courts
DRM
Gordon v MS
GPL
Grokdoc
HTML How To
IPI v RH
IV v. Google
Legal Docs
Lodsys
MS Litigations
MSvB&N
News Picks
Novell v. MS
Novell-MS Deal
ODF/OOXML
OOXML Appeals
OraclevGoogle
Patents
ProjectMonterey
Psystar
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v IBM
SCO v Novell
SCO:Soup2Nuts
SCOsource
Sean Daly
Software Patents
Switch to Linux
Transcripts
Unix Books

Gear

Groklaw Gear

Click here to send an email to the editor of this weblog.


You won't find me on Facebook


Donate

Donate Paypal


No Legal Advice

The information on Groklaw is not intended to constitute legal advice. While Mark is a lawyer and he has asked other lawyers and law students to contribute articles, all of these articles are offered to help educate, not to provide specific legal advice. They are not your lawyers.

Here's Groklaw's comments policy.


What's New

STORIES
No new stories

COMMENTS last 48 hrs
No new comments


Sponsors

Hosting:
hosted by ibiblio

On servers donated to ibiblio by AMD.

Webmaster
Citation provided | 248 comments | Create New Account
Comments belong to whoever posts them. Please notify us of inappropriate comments.
Citation provided
Authored by: artp on Wednesday, August 22 2012 @ 05:47 PM EDT
/var/log/btmp

Part of the /var/run/utmp and /var/log/wtmp trio that tracks
and records user logins on the system. Can keep some rather
embarrassing info around when you don't want it to. Mostly
not part of POSIX, but in general use anyway. Now being
replaced by utmpx, wtmpx and btmpx.

man utmp will give you the file formats, and Wikipedia has a
brief entry on utmp.

One of the basic security operations is to check the
permissions of btmp regularly.

Not all programs use the utmp group of files, but some
userspace programs do use them. ssh has an option to record
logins to utmp. Web servers used to when they first started,
but I don't know what they do today. Web servers used to
require a system username before they would allow a Web
login. Don't know if logging went out with that or not.

I had some hesitation about revealing this, but the bad guys
know it anyway. I've just given a lift to some script
kiddies, and provided some neophyte sysadmins some more
defensive ammunition.

---
Userfriendly on WGA server outage:
When you're chained to an oar you don't think you should go down when the galley
sinks ?

[ Reply to This | Parent | # ]

  • Citation provided - Authored by: Anonymous on Wednesday, August 22 2012 @ 07:54 PM EDT
    • Failed logins - Authored by: Anonymous on Thursday, August 23 2012 @ 05:26 AM EDT
Groklaw © Copyright 2003-2013 Pamela Jones.
All trademarks and copyrights on this page are owned by their respective owners.
Comments are owned by the individual posters.

PJ's articles are licensed under a Creative Commons License. ( Details )