Failed login attepts not being logged in /var/log/btmp

Bug #345074 reported by p0tw0r
Affects Status Importance Assigned to Milestone
sysvinit (Ubuntu)

Bug Description

Description: Ubuntu 8.04.2
Release: 8.04

lastb command should return failed login attempts, but returns nothing - both as user and root.
I have tried to log in with wrong passwords, wrong username, /var/log/btmp is still empty.
"last" works fine - but "lastb" does not work at all.

faillog is also not showing anything

The only place I could find login attempts is /var/log/auth.log

Revision history for this message
Victor Vargas (kamus) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please answer these questions:

* Is this reproducible?
* If so, what specific steps should we take to recreate this bug?
* by the way lastb man page say:

"Lastb is the same as last, except that by default it shows a log of the
file /var/log/btmp, which contains all the bad login attempts."

I try to reproduce this in Jaunty and lastb works fine, this package is logging in both log files ( /var/log/auth.log and /var/log/bmtp), can you try to reproduce this in your system with all last updates?


affects: ubuntu → sysvinit (Ubuntu)
Revision history for this message
sffroelich (sffroelich) wrote :

i found that my Ubuntu systems were not logging failed ssh logins, apparently due to the default file permissions on /var/log/btmp 660. i heard that sshd willnot log to a file with group writeable perms; when i changed the perms to 600, lastb started reporting failed attempts.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.