sshd not appending to /var/log/btmp

[Moses Moore]

SRU justification :
btmp logging had been removed in Debian a while ago due to protection to the /var/log/btmp file. This restriction is no longer true so it has been re-enabled on Debian.

Impact :
Failure to login using ssh will be recorded in /var/log/btmp.

Fix :
Change compilation time option

Test Case :
$ ssh badname@localhost # hit 'enter' three times to fail logging in.
$ sudo lastb

Expected outcome:
"lastb" reports something similar to:
"badname ssh:pts/1 localhost Sun Mar 27 17:01 - 17:01 (04:00)"
just as it does when a bad login attempt is made using /bin/login, or when using sshd on other distributions of linux (CentOS, Fedora, Arch, SUSE, ...etc)

Actual outcome
No mention of a bad login attempt in lastb output; /var/log/btmp modify time and byte size is unchanged.

Regression :
None expected, this used to be the default before it got disabled.

Original description of the problem :

Steps to reproduce:
$ ssh badname@localhost # hit 'enter' three times to fail logging in.
$ sudo lastb

Expected outcome:
"lastb" reports something similar to:
"badname ssh:pts/1 localhost Sun Mar 27 17:01 - 17:01 (04:00)"
just as it does when a bad login attempt is made using /bin/login, or when using sshd on other distributions of linux (CentOS, Fedora, Arch, SUSE, ...etc)

Actual outcome
No mention of a bad login attempt in lastb output; /var/log/btmp modify time and byte size is unchanged.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: openssh-server 1:5.3p1-3ubuntu6
Uname: Linux 2.6.18-128.2.1.el5.028stab064.7 x86_64
Architecture: amd64
Date: Sun Mar 27 16:40:55 2011
ProcEnviron:
 LANGUAGE=en_US.UTF-8
 LC_CTYPE=C
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: openssh

[Moses Moore (moses-mozai)]

A known quirk of sshd in other distros is that sshd will refuse to write to world- or group-readable /var/log/btmp. The fix for this is 'chmod 0600 /var/log/btmp'.

Ubuntu Linux installs /var/log/btmp with permissions 0660 (aka -rw-rw----). I already changed permissions to 0600 (aka -rw-------) and /var/log/btmp is still unaffected by bad login attempts via sshd.

[Serge Hallyn (serge-hallyn)]

/var/log/auth.log shows bad login attempts and I'd actually never heard of lastb, but confirmed that in natty btmp is not updated with bad login attempts from ssh.

[Serge Hallyn (serge-hallyn)]

This is actually not a bug. As of openssh (1:4.1p1-5), to close Debian bug #314956, btmp logging was turned off. If you want that re-enabled, please open a Debian bug.

[Colin Watson (cjwatson)]

Well, I was the one who turned that off, but I think we should keep this
bug open because the situation has changed. /var/log/btmp was mode 0664
in Debian when I made that change. Now, in Ubuntu (and possibly in
Debian, I haven't checked), it's mode 0660. This suggests to me that we
could re-enable the feature and just check for non-world-readability.

 status triaged

[André (andre-schlichting)]

The permission check of openssh is relaxed in revision 1.88 of loginrec.c
http://anoncvs.mindrot.org/index.cgi/openssh/loginrec.c
Would be nice to see this as an update in Lucid becaue with permission mode 0660 of /var/log/btmp I see no security concerns.

[Louis Bouchard (louis)]

btmp logging has now been re-enabled in Debian (see Debian bug #742775). It has also been synced back into Trusty. SRU is required for Saucy & Precise. I will take care of that

[Iain Lane (laney)]

Colin, do these patches make sense now?

[Chris J Arges (arges)]

@laney, I verified that in precise/saucy/trusty /var/log/btmp is set to 0660. With that and Colin's comment in #5, I think these do make sense.

[Chris J Arges (arges)]

Sponsored for P/S.

[Brian Murray (brian-murray)]

This was superceded by a security upload and will need to be redone for Saucy and Precise.

[Louis Bouchard (louis)]

New version of the debdiff from new version after security SRU

[Louis Bouchard (louis)]

New version of the debdiff from new version after security SRU

[Brian Murray (brian-murray)]

Hello Moses, or anyone else affected,

Accepted openssh into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/openssh/1:6.2p2-6ubuntu0.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello Moses, or anyone else affected,

Accepted openssh into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Bryan Quigley (bryanquigley)]

Verified fix on both precise and saucy..

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for openssh has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:6.2p2-6ubuntu0.4

---------------
openssh (1:6.2p2-6ubuntu0.4) saucy; urgency=medium

  * Re-enable btmp logging, as its permissions were fixed a long time ago.
    Backport from Debian and Trusty. (LP: #743858)
 -- Louis Bouchard <email address hidden> Tue, 22 Apr 2014 09:52:59 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:5.9p1-5ubuntu1.4

---------------
openssh (1:5.9p1-5ubuntu1.4) precise; urgency=medium

  * Re-enable btmp logging, as its permissions were fixed a long time ago.
    Backport from Debian and Trusty. (LP: #743858)
 -- Louis Bouchard <email address hidden> Tue, 22 Apr 2014 08:28:40 -0500