Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Security Incidents: Re: No 'Last Login:' info from bash?

Re: No 'Last Login:' info from bash?

From: Nate Carlson <natecars_at_REAL-TIME.COM>
Date: Wed, 4 Oct 2000 14:36:07 -0500

On Wed, 4 Oct 2000, Kris Boutilier wrote:
> Something strange happened on a few of our Redhat 6.0 (kernel
> 2.2.12-20) boxes this morning. When I went to login to the machines via
> a telnet session I didn't get any 'Last Login' reported by the shell.
> It's been a few days since I last accessed the machines, and scanning
> the system logs doesn't show any logins by anyone at all since my
> previous session (this is normal for these machines). I've done a
> cursory check for new or modified files (using GNU find) and nothing
> looks out of the ordinary. The machines haven't been restarted and all
> the log files seem to be intact...
>
> Is this something to be concerned about?

Have wtmp files possibly been rotated? I believe they are rotated
end-of-month by default on RedHat.. once you log out and log back in, do
you see the message? Does /var/log/wtmp.n exist?

Also, telnet is bad(tm).

--
Nate Carlson <natecars_at_real-time.com>   | Phone : (952)943-8700
http://www.real-time.com                | Fax   : (952)943-8500
Received on Oct 04 2000
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos