BTMP getprpw Mismatch

[MSwift]

I have a user who gets reported for failed login in getprpw (lockout=0001000), but the lastb -R does not report this failed login. lastb reports correctly when i try to do a failed login and for others too except this application ID. I have verified that the application is not running any cronjobs/etc which does a login. Any ideas!! system is 11.0 HP trusted.

Thanks

Mike

[Steven E. Protter]

Shalom,

Many admins have a script that periodically cleans up the btmp file. Perhaps this is clearing the data on the bad logins.

Also, people doing stuff they should not like to clean up after themselves.

SEP

[BUPA IS]

Hello,
Because, as I understand it, trusted system is sort of built around normal login. I think it goes like this:
If the user id and/or password are wrong. Log it in btmp and throw them out.
If the user id and password are correct then a good login is recorded in wtmp. After you get past this trusted system checks for other stuff in its database like time of day and admin lockout. If any of these fail the user is logged off and an invalid attempt is recorded in the trusted system database. Once the failied login count is reached for any reason the lockout out is set .

Another possiblity is that there may be corrupt entries in the btmp and wtmp files You check them using the fwtmp utility.

Also run pwck -s (or just authck -p) to check the integrity of the trusted system database files

Mike

[MSwift]

authck is fine and there are no scripts which clears the btmp (as i mentioned if i or my co-worker ) do a bad login it reports.

Thanks

Mike