|
Authored by: artp on Wednesday, August 22 2012 @ 05:47 PM EDT |
/var/log/btmp
Part of the /var/run/utmp and /var/log/wtmp trio that tracks
and records user logins on the system. Can keep some rather
embarrassing info around when you don't want it to. Mostly
not part of POSIX, but in general use anyway. Now being
replaced by utmpx, wtmpx and btmpx.
man utmp will give you the file formats, and Wikipedia has a
brief entry on utmp.
One of the basic security operations is to check the
permissions of btmp regularly.
Not all programs use the utmp group of files, but some
userspace programs do use them. ssh has an option to record
logins to utmp. Web servers used to when they first started,
but I don't know what they do today. Web servers used to
require a system username before they would allow a Web
login. Don't know if logging went out with that or not.
I had some hesitation about revealing this, but the bad guys
know it anyway. I've just given a lift to some script
kiddies, and provided some neophyte sysadmins some more
defensive ammunition.
---
Userfriendly on WGA server outage:
When you're chained to an oar you don't think you should go down when the galley
sinks ?[ Reply to This | Parent | # ]
|
- Citation provided - Authored by: Anonymous on Wednesday, August 22 2012 @ 07:54 PM EDT
- Failed logins - Authored by: Anonymous on Thursday, August 23 2012 @ 05:26 AM EDT
|
|
|
|