Failed login attepts not being logged in /var/log/btmp

Bug #345074 reported by p0tw0r on 2009-03-18
4
Affects Status Importance Assigned to Milestone
sysvinit (Ubuntu)
Undecided
Unassigned

Bug Description

Description: Ubuntu 8.04.2
Release: 8.04

lastb command should return failed login attempts, but returns nothing - both as user and root.
I have tried to log in with wrong passwords, wrong username, /var/log/btmp is still empty.
"last" works fine - but "lastb" does not work at all.

faillog is also not showing anything

The only place I could find login attempts is /var/log/auth.log

Kamus (kamus) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please answer these questions:

* Is this reproducible?
* If so, what specific steps should we take to recreate this bug?
* by the way lastb man page say:

"Lastb is the same as last, except that by default it shows a log of the
file /var/log/btmp, which contains all the bad login attempts."

I try to reproduce this in Jaunty and lastb works fine, this package is logging in both log files ( /var/log/auth.log and /var/log/bmtp), can you try to reproduce this in your system with all last updates?

Regards

affects: ubuntu → sysvinit (Ubuntu)
sffroelich (sffroelich) wrote :

i found that my Ubuntu systems were not logging failed ssh logins, apparently due to the default file permissions on /var/log/btmp 660. i heard that sshd willnot log to a file with group writeable perms; when i changed the perms to 600, lastb started reporting failed attempts.
-sff

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers