Security Incidents mailing list archives

Re: No 'Last Login:' info from bash?


From: Nate Carlson <natecars () REAL-TIME COM>
Date: Wed, 4 Oct 2000 14:36:07 -0500

On Wed, 4 Oct 2000, Kris Boutilier wrote:
 Something strange happened on a few of our Redhat 6.0 (kernel
2.2.12-20) boxes this morning. When I went to login to the machines via
a telnet session I didn't get any 'Last Login' reported by the shell.
It's been a few days since I last accessed the machines, and scanning
the system logs doesn't show any logins by anyone at all since my
previous session (this is normal for these machines). I've done a
cursory check for new or modified files (using GNU find) and nothing
looks out of the ordinary. The machines haven't been restarted and all
the log files seem to be intact...

 Is this something to be concerned about?

Have wtmp files possibly been rotated? I believe they are rotated
end-of-month by default on RedHat.. once you log out and log back in, do
you see the message? Does /var/log/wtmp.n exist?

Also, telnet is bad(tm).

--
Nate Carlson <natecars () real-time com>   | Phone : (952)943-8700
http://www.real-time.com                | Fax   : (952)943-8500


Current thread: