"last" command

[mornet]

Hello Everybody,

sorry for the language.
I know that the command last indicates last logins of users and ttys. So I try it on the L Class server under HPUX 11.00 and i see 49 "still logged in" users ! But There is only 2 users on the server at this moment.
The holder is 25/01/01. a lot of them are ftp connections.
I reboot the server the 14/04/2001 but when I do "last reboot", it gives 13/01/01 !!!
. What 's the probleme if there is? Have I to patch the server or there is an explication?

Thanks for all.
Thomas.

[Vincenzo Restuccia · Accepted solution]

s700_800 11.00 Year 2000 lastlogin patch(PHCO_21094)

[Account Not Used]

The "last" command has serious security holes in it. If I were you I would make sure I have all the latest patches and if you don't need to have it on your system I would remove it. Check the HP Security bulletins to find out more.

[Calvin Bebermeyer]

The last command seems to record users still logged in ... especially when users do not properly notify the server during ftp sessions with the "quit" command ... when the session is terminated abnormally (like just clicking the x on a PC window connection).

The who command will also show a user connected in some cases of abnormal termination of a session when they in fact are not.

For 11.0, this is normal behavior and so far, current patches have not fixed this.