topic chkrootkit lastlog in Operating System - HP-UX

chkrootkit lastlog

Priya_5 — Thu, 13 Oct 2005 03:09:41 GMT

What is the file used to store the last login information about the user in HP-UX? (An alternate to /var/adm/lastlog in UNIX )

Re: chkrootkit lastlog

Arunvijai_4 — Thu, 13 Oct 2005 03:12:19 GMT

/var/adm/wtmp which contains a record of all logins and logouts..

-Arun

Re: chkrootkit lastlog

Muthukumar_5 — Thu, 13 Oct 2005 03:14:11 GMT

Successful login informations are stored with /var/adm/utmp and bad login informations are stored in /var/adm/btmp.

hth.

Re: chkrootkit lastlog

Muthukumar_5 — Thu, 13 Oct 2005 03:14:56 GMT

It is /var/adm/wtmp not /var/adm/utmp :(

hth.

Re: chkrootkit lastlog

Muthukumar_5 — Thu, 13 Oct 2005 03:18:19 GMT

login service is storing into,

/var/adm/btmp History of bad login attempts
/var/adm/wtmp History of logins, logouts, and date changes

To audit this you can use last / lastb. However, if you are having any different file then, use last or lastb with -f option as,

Example:

# last -f /tmp/successlogin
# lastb -f /tmp/badlogin

hth.

Re: chkrootkit lastlog

Arunvijai_4 — Thu, 13 Oct 2005 03:22:09 GMT

For more information,
# man last or man lastb

-Arun

Re: chkrootkit lastlog

Muthukumar_5 — Thu, 13 Oct 2005 04:16:29 GMT

Did you get answer for this? Is it /var/adm/wtmp file?

I hope you are a newbie here. If the answer is correct then assign appropriate points.

See this:

http://forums1.itrc.hp.com/service/forums/helptips.do?#33

Every one in ITRC is great one and spending their time to share their GREAT technical skills to solve problem. ( I did not mean that it is me :)) )

Keep posting questions and assign points :)

thx.

Re: chkrootkit lastlog

Priya_5 — Thu, 13 Oct 2005 05:27:17 GMT

Thanx for ur valuable info (also for the point assignment link) MuthuKumar...

The answer you people gave helped me a little bit. Thank u very much.

Re: chkrootkit lastlog

Priya_5 — Thu, 13 Oct 2005 05:33:31 GMT

I would like to thank Muthukumar for his spl efforts in teaching the formalities...

In between I am sorry. As MuthuKumar said, I donot know anything about assigning points. Please donot reject my questions in the future for this issue.

Re: chkrootkit lastlog

Arunvijai_4 — Thu, 13 Oct 2005 06:20:30 GMT

Priya,
>The answer you people gave helped me a little bit. Thank u very much.

Please try to post full problem, so that we can discuss further in ITRC.

-Arun

Re: chkrootkit lastlog

Priya_5 — Thu, 13 Oct 2005 07:04:44 GMT

I am trying to use chkrootkit. There is a file named chklastlog.c where there is a hard code which refers the variable /usr/adm/lastlog.
------------------------------------------
#ifdef __FreeBSD__
#define WTMP_FILENAME "/var/log/wtmp"
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifdef __OpenBSD__
#define WTMP_FILENAME "/var/log/wtmp"
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifndef WTMP_FILENAME
#define WTMP_FILENAME "/var/adm/wtmp"
#endif
#ifndef LASTLOG_FILENAME
#define LASTLOG_FILENAME "/var/adm/lastlog"
#endif
.
.
.

Sinece there is no such file in hp-ux I need to replace a suitable file for that. Which one can I use? Is there any possibility to replace that? If I use /var/adm/wtmp as you people mentioned, I get irrelevant output.

Thanx in Advance

Re: chkrootkit lastlog

Arunvijai_4 — Thu, 13 Oct 2005 07:12:38 GMT

Is it something like,
#ifdef __HPUX__
#ifndef WTMP_FILENAME "/var/adm/wtmp"
#define WTMP_FILENAME "/var/adm/wtmp"
#endif

What output you get ?

-Arun

Re: chkrootkit lastlog

Priya_5 — Fri, 14 Oct 2005 01:48:54 GMT

# ./chklastlog
user root deleted or never logged from lastlog!
user shyam deleted or never logged from lastlog!
user rita deleted or never logged from lastlog!
user reghu deleted or never logged from lastlog!
user pranesh deleted or never logged from lastlog!
user f deleted or never logged from lastlog!
user rama deleted or never logged from lastlog!
user kavitha deleted or never logged from lastlog!
user deepa deleted or never logged from lastlog!

I'am very much cruious to know what is the exact content of the files /var/adm/lastlog and /var/adm/wtmp.

If these contents differs, can the entries in wtmp file really replace lastlog entries.

Is this trial correct?

Re: chkrootkit lastlog

Arunvijai_4 — Fri, 14 Oct 2005 01:55:20 GMT

You can try this,
# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp |more

Also
man wtmp
man btmp
man utmp

should help. /var/adm/lastlog is not applicable to HP-UX..

-Arun