Need to know how the system shows your last sucessful and un-sucessful login time.

[Amruth]

Hello admins,

As far as i know if a server is a trusted one it is shown by default.

But do anybody know where it is mentioned to display these when you login.

Need to know this for a security Audit.

THanks in Advance.
AM

[Steven E. Protter]

last
takes data from /var/adm/wtmp
lastb
takes data from /var/adm/btmp

strings command will get you raw data.

last -R

lastb -R

Gets you the host the login came from.

SEP

[Amruth]

Hi,

Wants to know where you specify in the system (in one of the config files) so that it will get displayed while you login.

Thanks,
AM

[Sridhar Bhaskarla]

HI,

It's the 'login' process that displays this information if the system is trusted. It gets the information from 'btmp|wtmp' files under /var/adm/ directory.

-Sri

[Sridhar Bhaskarla]

I don't think you cannot change that behaviour. '/usr/bin/login' that runs when a user logs in will display last successful and unsuccessful logins if the system is trusted.

-Sri

[Sridhar Bhaskarla]

*** I don't think you can change that behaviour*** Fat finger.

-Sri
PS: 0 points pls.

[Amruth]

I do agree with you man.

Regards,
AM

[MarkSyder]

How about putting two lines in the user's .profile:

last|grep `whoami`|head -2
lastb|grep `whoami`|head -1

The reason for head -2 on the last command is that head -1 would only show you the current login.

Mark Syder (like the drink but spelt different)