bad logins

[Jerry L. Sims]

Hello Fellow HP-uxer's ( smile ):

Can any one tell me the best way to cleanup
the /var/adm/btmp ( data file )? Someone
with root access attempted to login to the system, and typed the root password instead of
the login ID. Now the root password is sitting
there ( /var/adm/btmp ) in plain test. Do I have to:
o remove "/var/adm/btmp"?
o create a new root password ?

or is their another way to just remove the embedded password, and leave the rest of the data in place? Please advise, and thanks for the help.

[Helen French]

You can do this:

# > /var/adm/btmp

This will nullify the file. You don't need to remove the file or create new root password.

[Sridhar Bhaskarla · Accepted solution]

Hi,

You can use 'fwtmp' to do the job for you. Convert the binary file to ascii. Edit it and make changes and then convert it back to binary.

#cd /usr/sbin/acct
#./fwtmp < /var/adm/btmp > btmp.txt

vi btmp.txt (search for the string and delete it)
#./fwtmp -ic < btmp.txt > /var/adm/btmp

You will need to remember that after overwriting the existing btmp file, you will lose the bad logins during that time frame.

-Sri

[A. Clay Stephenson]

I would use fwtmp to read in the binary file and produce a text file output. Edit this text file and then use fwtmp -ic to read in the text file to produce a new btmp file minus anything you want to throw away. Man fwtmp for details.

[Tom Danzig]

The easiest thing to do is zero out the file as described above. If you want to save the contenets you can do:

cat /var/adm/btmp | /usr/sbin/acct/fwtmp > /tmp/ascii_btmp

vi /tmp/ascii_btmp to delete the records you want.

cat /tmp/ascii_btmp | /usr/sbin/acct/fwtmp -ic > /var/adm/btmp

This will allow you to remove the offending line.

[Uday_S_Ankolekar]

The files can be zeroed or removed but if they are removed they need to be
manually recreated as they not created by the programs that maintain them.
Thus, if these files are removed, record-keeping is turned off.

If you want to recreate them note the ownerships and permissions before
removing them and reset the ownerships and permissions after recreating the
files (usually with touch to create an empty files). This is EXTREMELY
important -> especially for the btmp file.

-USA..

[Steven E. Protter]

> /var/adm/btmp

This will clear the file and you should do that periodically for this very reason.


log in as root

passwd

SEP

[Bill Hassell]

It sounds like btmp has the wrong permissions!!! last and lastb are the same program and they are both section 1 commands, that is, available to all users. The /var/adm/btmp file must NEVER be readable by anyone except root. The reason is as you have already stated--someone wasn't watching and typed to password as the login and vice-versa. You can always zero the entire file but the most important is to change permissions to 600. If this is an obsolete version of HP-UX (10.20 or earlier), the btmp file had to be created before bad logins were logged, and since the default (yuck) umask is zero, the file would be created with 666 permissions.

The problem with btmp isn't just with root, it is true for any user. lastb is a hacker's best friend as it only shows mistakes and passwords are easy to see when the user makes a mistake.,