From: Benjamin Bennett (benpsc.edu)
Date: Thu Mar 02 2006 - 10:36:14 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, 2006-03-02 at 17:23 +0100, GroundZero Security wrote:
> Well i dont want to destroy your happy time where you can feel superior, but
> if you would read the manpage of lastb you would notice that this approach wont work at all.
> lastb just shows successfull logins! not all the attempted logins....we discussed that before though,
> so better pay attention next time.
>
> Another thing is that on many systems btmp is not present and thus lastb wouldnt work even if it
> would show failed logins.
>
> NAME
> last, lastb - show listing of last logged in users
>
> SYNOPSIS
> last [-R] [-num] [ -n num ] [-adiox] [ -f file ] [name...] [tty...]
> lastb [-R] [-num] [ -n num ] [ -f file ] [-adiox] [name...] [tty...]
>
> DESCRIPTION
> Last searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all
> users logged in (and out)
> since that file was created.
> ....

...and a little farther down...

  "Lastb is the same as last, except that by default it shows a log of
the file /var/log/btmp, which contains all the bad login attempts."

> as you can see it only logs "logged in" users not all those that tried. so your script is useless.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBEBx7+7bIoEUY3yn8RAs9IAJ9KMS7ft0QUgFQU7pvUZNQI/T42eQCgqhYR
xI++0fH2jILD824sBznw41M=
=es8O
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]