Failed login attepts not being logged in /var/log/btmp

[p0tw0r]

Description: Ubuntu 8.04.2
Release: 8.04

lastb command should return failed login attempts, but returns nothing - both as user and root.
I have tried to log in with wrong passwords, wrong username, /var/log/btmp is still empty.
"last" works fine - but "lastb" does not work at all.

faillog is also not showing anything

The only place I could find login attempts is /var/log/auth.log

[Victor Vargas (kamus)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please answer these questions:

* Is this reproducible?
* If so, what specific steps should we take to recreate this bug?
* by the way lastb man page say:

"Lastb is the same as last, except that by default it shows a log of the
file /var/log/btmp, which contains all the bad login attempts."

I try to reproduce this in Jaunty and lastb works fine, this package is logging in both log files ( /var/log/auth.log and /var/log/bmtp), can you try to reproduce this in your system with all last updates?

Regards

[sffroelich (sffroelich)]

i found that my Ubuntu systems were not logging failed ssh logins, apparently due to the default file permissions on /var/log/btmp 660. i heard that sshd willnot log to a file with group writeable perms; when i changed the perms to 600, lastb started reporting failed attempts.
-sff