Linux Security Cookbook [Electronic resources] نسخه متنی

Recipe 9.5 Checking for Suspicious Account Use

9.5.1 Problem

You want to discover unusual or
dangerous usage of accounts on your system:


dormant user
accounts, recent logins to system accounts, etc.

9.5.2 Solution

To print
information about the last

login for each user:

$ lastlog [-u username]

To print the entire login history:

$ last [username]

To print failed login attempts:

$ lastb [username]

To enable recording of bad logins:

# touch /var/log/btmp
# chown --reference=/var/log/wtmp /var/log/btmp
# chmod --reference=/var/log/wtmp /var/log/btmp

9.5.3 Discussion

Attackers look for
inactive accounts that are still enabled, in the hope that intrusions
will escape detection for long periods of time. If Joe retired and
left the organization last year, will anyone notice if his account
becomes compromised? Certainly not Joe! To avoid problems like this,
examine all accounts on your system for unexpected usage patterns.

Linux systems record each user's last login time in
the database
/var/log/lastlog.
The terminal (or
X Window System display name)
and remote system name, if any, are also noted. The
lastlog command prints this information in a
convenient, human-readable format.

/var/log/lastlog is a database, not a log file. It does not grow continuously, and therefore should not be rotated. The apparent size of the file (e.g., as displayed by ls -l) is often much larger than the actual size, because the file contains "holes" for ranges of unassigned user IDs. Access is restricted to the superuser by recent versions of Red Hat (8.0 or later). If this seems too paranoid for your system, it is safe to make the file world-readable: # chmod a+r /var/log/lastlog In contrast, the btmp log file will grow slowly (unless you are under attack!), but it should be rotated like other log files. You can either add btmp to the wtmp entry in /etc/logrotate.conf, or add a similar entry in a separate file in the /etc/logrotate.d directory. [Recipe 9.30]

A history of all logins and logouts
(interspersed with system events like



shutdowns,
reboots, runlevel changes, etc.) is recorded in the log file
/var/log/wtmp.
The last command scans
this log file to produce a report of all login sessions, in reverse
chronological order, sorted by login time.

Failed login attempts can also be recorded in the log file
/var/log/btmp, but this is not done by default.
To enable recording of bad logins, create the
btmp file manually, using the same owner, group,
and permissions as for the wtmp file. The
lastb command prints a history of bad logins.

The preceding methods do not scale well to multiple systems, so see
our more general solution. [Recipe 9.6]

9.5.4 See Also

lastlog(1), last(1), lastb(1).