chkrootkit lastlog

[Priya_5]

What is the file used to store the last login information about the user in HP-UX? (An alternate to /var/adm/lastlog in UNIX )

[Arunvijai_4]

/var/adm/wtmp which contains a record of all logins and logouts..

-Arun

[Muthukumar_5]

Successful login informations are stored with /var/adm/utmp and bad login informations are stored in /var/adm/btmp.

hth.

[Muthukumar_5]

It is /var/adm/wtmp not /var/adm/utmp :(

hth.

[Muthukumar_5]

login service is storing into,

/var/adm/btmp History of bad login attempts
/var/adm/wtmp History of logins, logouts, and date changes


To audit this you can use last / lastb. However, if you are having any different file then, use last or lastb with -f option as,

Example:

# last -f /tmp/successlogin
# lastb -f /tmp/badlogin

hth.

[Arunvijai_4]

For more information,
# man last or man lastb

-Arun

[Muthukumar_5]

Did you get answer for this? Is it /var/adm/wtmp file?

I hope you are a newbie here. If the answer is correct then assign appropriate points.

See this:

http://forums1.itrc.hp.com/service/forums/helptips.do?#33

Every one in ITRC is great one and spending their time to share their GREAT technical skills to solve problem. ( I did not mean that it is me :)) )

Keep posting questions and assign points :)

thx.

[Priya_5]

Thanx for ur valuable info (also for the point assignment link) MuthuKumar...

The answer you people gave helped me a little bit. Thank u very much.

[Priya_5]

I would like to thank Muthukumar for his spl efforts in teaching the formalities...

In between I am sorry. As MuthuKumar said, I donot know anything about assigning points. Please donot reject my questions in the future for this issue.

[Arunvijai_4]

Priya,
>The answer you people gave helped me a little bit. Thank u very much.

Please try to post full problem, so that we can discuss further in ITRC.

-Arun

[Priya_5]

I am trying to use chkrootkit. There is a file named chklastlog.c where there is a hard code which refers the variable /usr/adm/lastlog.
------------------------------------------
#ifdef __FreeBSD__
#define WTMP_FILENAME "/var/log/wtmp"
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifdef __OpenBSD__
#define WTMP_FILENAME "/var/log/wtmp"
#define LASTLOG_FILENAME "/var/log/lastlog"
#endif
#ifndef WTMP_FILENAME
#define WTMP_FILENAME "/var/adm/wtmp"
#endif
#ifndef LASTLOG_FILENAME
#define LASTLOG_FILENAME "/var/adm/lastlog"
#endif
.
.
.

Sinece there is no such file in hp-ux I need to replace a suitable file for that. Which one can I use? Is there any possibility to replace that? If I use /var/adm/wtmp as you people mentioned, I get irrelevant output.

Thanx in Advance

[Arunvijai_4]

Is it something like,
#ifdef __HPUX__
#ifndef WTMP_FILENAME "/var/adm/wtmp"
#define WTMP_FILENAME "/var/adm/wtmp"
#endif

What output you get ?

-Arun

[Priya_5]

# ./chklastlog
user root deleted or never logged from lastlog!
user shyam deleted or never logged from lastlog!
user rita deleted or never logged from lastlog!
user reghu deleted or never logged from lastlog!
user pranesh deleted or never logged from lastlog!
user f deleted or never logged from lastlog!
user rama deleted or never logged from lastlog!
user kavitha deleted or never logged from lastlog!
user deepa deleted or never logged from lastlog!


I'am very much cruious to know what is the exact content of the files /var/adm/lastlog and /var/adm/wtmp.

If these contents differs, can the entries in wtmp file really replace lastlog entries.

Is this trial correct?

[Arunvijai_4]

You can try this,
# cat /var/adm/wtmp | /usr/sbin/acct/fwtmp |more

Also
man wtmp
man btmp
man utmp

should help. /var/adm/lastlog is not applicable to HP-UX..

-Arun