system not logging to btmp

[Jeff Oliver]

Hi,

My HPUX 11 system is not logging to /var/adm/btmp, but /var/adm/wtmp is working fine. Both are in /etc, as other threads have described. Is there a system or inetd service that needs to be running for btmp to work? What would cause it to not work (other than that I'm an idiot)?

Regards,

Jeff

[Vladislav Demidov]

Hello Jeff,
You have to create /var/adm/btmp by youself.
run touch /var/adm/btmp

[Sanjay_6]

Hi Jeff,

The file /etc/btmp should be lined to /var/adm/btmp.

cd /etc
ll btmp
btmp --> /var/adm/btmp

The file permission on /etc/btmp are lrwxrwxrwt and the permission on /var/adm/btmp are -rw-------

Hope this helps.

Regds

[Jeff Oliver]

Hi,

All of this is set up as everyone has instructed. /var/adm/btmp exists and /etc/btmp is linked to it. Similarly /var/adm/wtmp exists and /etc/wtmp is linked to it. wtmp is logging information, but btmp is not.

Any ideas?

Regards,

Jeff

[Sanjay_6]

Hi Jeff,

suggest you remove the existing /var/adm/btmp file and create a new file with 0 bytes and see if it starts logging. There is no configuration variable for this purpose.

cat /dev/null >/var/adm/btmp

Hope this helps.

Regds

[Jeff Oliver]

Sanjay,

Well, now it gets interesting. I recreated the file as you said, and it still didn't seem to work. BUT, it does work...my testing method just wasn't valid.

You see, I have disabled telnet and only allow shell access via ssh. Ssh for some reason either doesn't use "login", or I have some parameter in sshd mis-configure. Because when I try to ssh to the server with a bogus account, nothing gets logged to btmp, but when I just execute "login" from the command prompt and type bogus info, information is sent to btmp.

Sooooo, I guess my question changes to why isn't ssh routing invalid logins to btmp? Should I ask this in a different thread? Do you have any ideas?

Jeff

[Sanjay_6 · Accepted solution]

Hi Jeff,

I can't say you should this question in another thread. You can leave the question over here and wait for the responses if you can. If you don't get some good answers post it as a seperate thread. Don't allot 8 or more points to anyone till you get the results in this thread.

Regds

[Sanjay_6]

Hi Jeff,

See if there is a file called /var/log/secure and if it is logging the bad login attempts using ssh.

Hope this helps.

Regds

[Jeff Oliver]

Sanjay,

It turns out that, at least on the version of sshd I'm running, use of btmp is not supported. From the installation notes:

----
Mechanisms for updating wtmp, utmp, lastlog, and similar mechanisms
are not standardized. Ssh substitutes many of the functions of the
conventional login program. These functions are implemented in login.c.
You may need to modify this file to make it work on exotic systems.
Please send any modifications and bug fixes back to the author for inclusion
in the distribution. If you just want to try ssh, and cannot get this file
to compile, if is safe to define all of the functions as empty; however,
in that case logins will not be logged.
---------

So far, what I've seen from even the most recent version of openssh, it's still not supported. All the developers ever seem to say is "if you want the feature, add it yourself"...a typical response when its something this obscure I suppose. I'm going to post a new thread and give you the 8 points...you deserve it as you got me thinking and digging. thanks.

Jeff