O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 10] Auditing and Logging
Login name: tim In real life: Tim Hack
Directory: /Users/tim Shell: /bin/csh
Last login Tue Jul 12 07:49:59 on tty01
No unread mail
No Plan.
%
Some versions of System V UNIX display both the last successful login and the last unsuccessful login when a user
logs into the system:
login: tim
password: books2sell
Last successful login for tim : Tue Jul 12 07:49:59 on tty01
Last unsuccessful login for tim : Tue Jul 06 09:22:10 on tty01
Teach your users to check the last login time each time they log in. If the displayed time doesn't correspond to the
last time they used the system, somebody else might have been using their account. If this happens, the user should
immediately change the account's password and notify the system administrator.
Unfortunately, the design of the lastlog mechanism is such that the previous contents of the file are overwritten at
each login. As a result, if a user is inattentive for even a moment, or if the login message clears the screen, the user
may not notice a suspicious time. Furthermore, even if a suspicious time is noted, it is no longer available for the
system administrator to examine.
One way to compensate for this design flaw is to have a cron-spawned task periodically make an on-disk copy of the
file that can be examined at a later time. For instance, you could have a shell file run every six hours to do the
following:
mv /var/adm/lastlog.3 /var/adm/lastlog.4
mv /var/adm/lastlog.2 /var/adm/lastlog.3
mv /var/adm/lastlog.1 /var/adm/lastlog.2
cp /var/adm/lastlog /var/adm/lastlog.1
This will preserve the contents of the file in six-hour periods. If backups are done every day, then they will also be
preserved to the backups for examination later.
If you have saved copies of the lastlog file, you will need a way to read the contents. Unfortunately, there is no
utility under standard versions of UNIX that allows you to read one of these files and print all the information.
Therefore, you need to write your own. The following Perl script will work on SunOS systems, and you can modify
it to work on others.[3]
[3] The layout of the lastlog file is usually documented in an include file such as /usr/include/lastlog.h
Example 10.1: Script that Reads lastlog File.
#!/usr/local/bin/perl
$fname = (shift || "/var/adm/lastlog");
$halfyear = 60*60*24*365.2425/2; # pedantry abounds
setpwent;
while (($name, $junk, $uid) = getpwent) {
$names{$uid} = $name;
}
endpwent;
open(LASTL, $fname);
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch10_01.htm (4 of 9) [2002-04-12 10:44:56]