Lesson 1.15: Login records and their gaps
Linux keeps several independent records of who logged in: wtmp (last), btmp (lastb, the failures), lastlog (the latest login per account) and the authentication log. Attackers who get root often edit one of them; they rarely fix all of them. In the lab Northwind's Git server was compromised overnight. You read each record, count a password-guessing burst, find a root login that the session history doesn't show, and prove that wtmp was edited by cross-checking it against the others.
19 min
You will learn to
- Know what wtmp, btmp, lastlog and auth.log each record
- Read last and lastb output
- Count failed logins by source
- Cross-check records to find a deleted session
- Read raw records with utmpdump
Key terms
- wtmp
- Binary history of logins, logouts and boots; read with last.
- btmp
- Failed login attempts; readable only by root; read with lastb.
- lastlog
- One record per account: the most recent login only.
- auth.log
- Text log of authentication from sshd, sudo, PAM, written by rsyslog.
- utmpdump
- Prints utmp/wtmp/btmp records as text; with -r turns text back into records.
- Indicator removal
- Attackers clearing or editing logs and records to hide.
← Reading a process through /proc · All lessons · Hunting processes and connections with osquery →