sshd not appending to /var/log/btmp

Bug #743858 reported by Moses Moore on 2011-03-27
30
This bug affects 4 people
Affects Status Importance Assigned to Milestone
openssh (Ubuntu)
Medium
Unassigned
Precise
Medium
Unassigned
Saucy
Medium
Unassigned
Trusty
Medium
Unassigned

Bug Description

SRU justification :
btmp logging had been removed in Debian a while ago due to protection to the /var/log/btmp file. This restriction is no longer true so it has been re-enabled on Debian.

Impact :
Failure to login using ssh will be recorded in /var/log/btmp.

Fix :
Change compilation time option

Test Case :
$ ssh badname@localhost # hit 'enter' three times to fail logging in.
$ sudo lastb

Expected outcome:
"lastb" reports something similar to:
"badname ssh:pts/1 localhost Sun Mar 27 17:01 - 17:01 (04:00)"
just as it does when a bad login attempt is made using /bin/login, or when using sshd on other distributions of linux (CentOS, Fedora, Arch, SUSE, ...etc)

Actual outcome
No mention of a bad login attempt in lastb output; /var/log/btmp modify time and byte size is unchanged.

Regression :
None expected, this used to be the default before it got disabled.

Original description of the problem :

Steps to reproduce:
$ ssh badname@localhost # hit 'enter' three times to fail logging in.
$ sudo lastb

Expected outcome:
"lastb" reports something similar to:
"badname ssh:pts/1 localhost Sun Mar 27 17:01 - 17:01 (04:00)"
just as it does when a bad login attempt is made using /bin/login, or when using sshd on other distributions of linux (CentOS, Fedora, Arch, SUSE, ...etc)

Actual outcome
No mention of a bad login attempt in lastb output; /var/log/btmp modify time and byte size is unchanged.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: openssh-server 1:5.3p1-3ubuntu6
Uname: Linux 2.6.18-128.2.1.el5.028stab064.7 x86_64
Architecture: amd64
Date: Sun Mar 27 16:40:55 2011
ProcEnviron:
 LANGUAGE=en_US.UTF-8
 LC_CTYPE=C
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: openssh

Moses Moore (moses-mozai) wrote :
Moses Moore (moses-mozai) wrote :

A known quirk of sshd in other distros is that sshd will refuse to write to world- or group-readable /var/log/btmp. The fix for this is 'chmod 0600 /var/log/btmp'.

Ubuntu Linux installs /var/log/btmp with permissions 0660 (aka -rw-rw----). I already changed permissions to 0600 (aka -rw-------) and /var/log/btmp is still unaffected by bad login attempts via sshd.

Serge Hallyn (serge-hallyn) wrote :

/var/log/auth.log shows bad login attempts and I'd actually never heard of lastb, but confirmed that in natty btmp is not updated with bad login attempts from ssh.

Changed in openssh (Ubuntu):
status: New → Confirmed
importance: Undecided → Medium
Serge Hallyn (serge-hallyn) wrote :

This is actually not a bug. As of openssh (1:4.1p1-5), to close Debian bug #314956, btmp logging was turned off. If you want that re-enabled, please open a Debian bug.

Changed in openssh (Ubuntu):
status: Confirmed → Won't Fix

Well, I was the one who turned that off, but I think we should keep this
bug open because the situation has changed. /var/log/btmp was mode 0664
in Debian when I made that change. Now, in Ubuntu (and possibly in
Debian, I haven't checked), it's mode 0660. This suggests to me that we
could re-enable the feature and just check for non-world-readability.

 status triaged

Changed in openssh (Ubuntu):
status: Won't Fix → Triaged
André (andre-schlichting) wrote :

The permission check of openssh is relaxed in revision 1.88 of loginrec.c
http://anoncvs.mindrot.org/index.cgi/openssh/loginrec.c
Would be nice to see this as an update in Lucid becaue with permission mode 0660 of /var/log/btmp I see no security concerns.

Louis Bouchard (louis) wrote :

btmp logging has now been re-enabled in Debian (see Debian bug #742775). It has also been synced back into Trusty. SRU is required for Saucy & Precise. I will take care of that

Changed in openssh (Ubuntu):
status: Triaged → Confirmed
assignee: nobody → Louis Bouchard (louis-bouchard)
Louis Bouchard (louis) on 2014-03-31
description: updated
Louis Bouchard (louis) on 2014-03-31
Changed in openssh (Ubuntu Saucy):
assignee: nobody → Louis Bouchard (louis-bouchard)
Changed in openssh (Ubuntu Precise):
assignee: nobody → Louis Bouchard (louis-bouchard)
Changed in openssh (Ubuntu Saucy):
importance: Undecided → Medium
Changed in openssh (Ubuntu Precise):
importance: Undecided → Medium
status: New → In Progress
Changed in openssh (Ubuntu Saucy):
status: New → In Progress
Changed in openssh (Ubuntu Trusty):
status: Confirmed → Fix Released
Iain Lane (laney) wrote :

Colin, do these patches make sense now?

Chris J Arges (arges) wrote :

@laney, I verified that in precise/saucy/trusty /var/log/btmp is set to 0660. With that and Colin's comment in #5, I think these do make sense.

Chris J Arges (arges) wrote :

Sponsored for P/S.

Brian Murray (brian-murray) wrote :

This was superceded by a security upload and will need to be redone for Saucy and Precise.

Louis Bouchard (louis) wrote :

New version of the debdiff from new version after security SRU

Louis Bouchard (louis) wrote :

New version of the debdiff from new version after security SRU

Hello Moses, or anyone else affected,

Accepted openssh into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/openssh/1:6.2p2-6ubuntu0.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in openssh (Ubuntu Saucy):
status: In Progress → Fix Committed
tags: added: verification-needed
Changed in openssh (Ubuntu Precise):
status: In Progress → Fix Committed
Brian Murray (brian-murray) wrote :

Hello Moses, or anyone else affected,

Accepted openssh into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Bryan Quigley (bryanquigley) wrote :

Verified fix on both precise and saucy..

tags: added: verification-done
removed: verification-needed

The verification of the Stable Release Update for openssh has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package openssh - 1:6.2p2-6ubuntu0.4

---------------
openssh (1:6.2p2-6ubuntu0.4) saucy; urgency=medium

  * Re-enable btmp logging, as its permissions were fixed a long time ago.
    Backport from Debian and Trusty. (LP: #743858)
 -- Louis Bouchard <email address hidden> Tue, 22 Apr 2014 09:52:59 -0500

Changed in openssh (Ubuntu Saucy):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package openssh - 1:5.9p1-5ubuntu1.4

---------------
openssh (1:5.9p1-5ubuntu1.4) precise; urgency=medium

  * Re-enable btmp logging, as its permissions were fixed a long time ago.
    Backport from Debian and Trusty. (LP: #743858)
 -- Louis Bouchard <email address hidden> Tue, 22 Apr 2014 08:28:40 -0500

Changed in openssh (Ubuntu Precise):
status: Fix Committed → Fix Released
Louis Bouchard (louis) on 2014-05-07
Changed in openssh (Ubuntu):
assignee: Louis Bouchard (louis-bouchard) → nobody
Changed in openssh (Ubuntu Saucy):
assignee: Louis Bouchard (louis-bouchard) → nobody
Changed in openssh (Ubuntu Precise):
assignee: Louis Bouchard (louis-bouchard) → nobody
Changed in openssh (Ubuntu Trusty):
assignee: Louis Bouchard (louis-bouchard) → nobody
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers