getprpw -m slogint & ssh logins

[Shouvik Basak]

I need to find out the successful last login time for the user accounts on a trusted HP-UX server. Within a simple script I use:

getprpw -m slogint

This reports correctly for all logins done through "telnet" but does not consider any logins done through "ssh".

For eg. a user has logged in through ssh yesterday but that entry is not shown. Instead the last time he logged in to the system about a month back is reflected. Any successful logins through ssh to the system is not being shown in last successful login listing. This is happening for all relevant user accounts on multiple servers.

Note: i do no want to use "last", as i would use the output data for users who have logged in months before too.

Looking forward to suggestions from you how I may get this right.

Thanks in anticipation.
-Shouvik

[Bill Hassell · Accepted solution]

This appears to be a difficulty with SSH which uses PAM for authentication. This problem also affects auditing. The suggested workaround is last (wtmp) or setup HIDS (host Intruder Detection Software at http://www.docs.hp.com/en/internet.html#Host%20Intrusion%20Detection%20System)

The wtmp file does contain a complete date for each login/logout (MM/DD/YY) but the last program apparently does not pay any attention to the year, thus leading to 'ghost' logins. This is a defect in last, not the wtmp file so you can use the wtmp decoder program fwtmp as in:

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > myfile

Now you can find the last login for a given user regardless of the size of wtmp.