In hunting on dejanews, I came across this post in response to this same
question quite awhile back. It mentions differences in login from
linux-utils and shadow packages. Have these been addressed, and how can I
tell which login my system is using?
--Start Dejanews post----------------------
(me posting long ago:)
>: I do not get any bad login attempts logged to /var/log/btmp and
>: 'lastb' does not show any entries from it.
>: /var/log/btmp exists. 'last' works fine.
>
>Simple - util-linux login doesn't write anything to /var/log/btmp.
>You need login from the shadow suite for that - it can be configured
>to log the information you need (FTMP_FILE in /etc/login.defs).
Just to clarify, since I wrestled with this exact problem last night.
The progs lastb and last come from the sysvinit package (lastb is a
symlink to last).
The problem is that you need a login that writes login fails to
/var/log/btmp ... that comes from the shadow package. Marek is
correct about the change needed. By default login uses ftmp to
record failures. I fixed this ass-backwards, and changed last to
look for ftmp instead of btmp -- not recommended. You could also
just use utmpdump to examine /var/log/ftmp , though lastb has a
nicer output.
--End Dejanews Post----------------------
Thanks
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com/RedHat-FAQ /RedHat-Errata /RedHat-Tips /mailing-lists
To unsubscribe: mail [EMAIL PROTECTED] with
"unsubscribe" as the Subject.
