Date: Sat, 7 Jul 2001 18:44:14 -0700 From: "Crist J. Clark" <cristjc@earthlink.net> To: Igor Roshchin <str@giganda.komkon.org> Cc: security@FreeBSD.ORG Subject: Re: wtmp corrupted - ? Message-ID: <20010707184414.H408@blossom.cjclark.org> In-Reply-To: <200107072220.f67MKJ613641@giganda.komkon.org>; from str@giganda.komkon.org on Sat, Jul 07, 2001 at 06:20:19PM -0400 References: <200107072220.f67MKJ613641@giganda.komkon.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jul 07, 2001 at 06:20:19PM -0400, Igor Roshchin wrote: > > Hello! > > I've just found that my wtmp file is corrupted. > (See the output of last(1) below). > Is this a bug or is it a sign of somebody trying to clear his trace ? > (This is on 4.3-RELEASE). > > Are there any tools around which allow to easily read a corrupted wtmp ? I had this problem on a Solaris box. A poorly written app would not log people off properly and eventually consume all ttys. People could then not log in. The admin of the box discovered that if she, # cp /dev/null /var/adm/wtmp It would "fix" the problem, and people could get in. *Grrr* Anyway I ended up with some damaged files. I built a quick C program to read the file and then just used head(1) and tail(1) to recover what was recoverable. The contents of a wtmp file are simple and defined in wtmp(5) (just cut and paste). It would also be pretty easy to write a Perl script to do it. Sorry, I don't have the little program with me at the moment. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010707184414.H408>