2

I have installed Kali Linux and I found some puzzling entries in wtmp log file. Unknown user logs in for a short while when I boot my computer or switch accounts and most of the time when I shut down.

Can you please explain what is the reason for these entries? I have used Ubuntu for a while and I have never seen this kind of entries. I also find it puzzling that it uses after each log out new console, which is one higher than the previous, i.e tty7 > tty8 > tty9 (see the entries from March 7th).

This is a sample from my wtmp log file given by the command "last":

account  pts/0        :0.0             Fri Mar  7 18:50   still logged in   
account  tty9         :0               Fri Mar  7 18:50   still logged in   
(unknown tty9         :0               Fri Mar  7 18:50 - 18:50  (00:00)    
root     pts/0        :0.0             Fri Mar  7 18:49 - 18:49  (00:00)    
root     tty8         :0               Fri Mar  7 18:49 - 18:50  (00:00)    
(unknown tty8         :0               Fri Mar  7 18:49 - 18:49  (00:00)    
account  pts/0        :0.0             Fri Mar  7 18:48 - 18:49  (00:00)    
account  tty7         :0               Fri Mar  7 18:48 - 18:49  (00:00)    
(unknown tty7         :0               Fri Mar  7 18:48 - 18:48  (00:00)    
reboot   system boot  3.12-kali1-amd64 Fri Mar  7 18:47 - 18:50  (00:02)
...
(unknown tty8         :0               Thu Mar  6 10:25 - down   (00:00)    
account  pts/1        :0.0             Wed Mar  5 20:51 - 09:42  (12:50)    
account  pts/0        :0.0             Wed Mar  5 20:49 - 09:42  (12:52)    
account  tty7         :0               Wed Mar  5 20:49 - 10:25  (13:35)    
(unknown tty7         :0               Wed Mar  5 20:49 - 20:49  (00:00)    
reboot   system boot  3.12-kali1-amd64 Wed Mar  5 20:49 - 10:25  (13:35)    
account  pts/1        :0.0             Tue Mar  4 19:22 - 03:13  (07:50)    
account  pts/0        :0.0             Tue Mar  4 19:21 - 03:13  (07:51)    
account  tty8         :0               Tue Mar  4 19:11 - 03:14  (08:02)    
(unknown tty8         :0               Tue Mar  4 19:11 - 19:11  (00:00)    
root     pts/1        :0.0             Tue Mar  4 17:51 - 19:11  (01:19)    
root     pts/0        :0.0             Tue Mar  4 17:50 - 19:11  (01:20)    
root     tty7         :0               Tue Mar  4 17:50 - 19:11  (01:20)    
(unknown tty7         :0               Tue Mar  4 17:49 - 17:50  (00:00)    
reboot   system boot  3.12-kali1-amd64 Tue Mar  4 17:49 - 03:14  (09:24)
  • Is this output from the lastlog command? – slm Mar 7 '14 at 14:14
  • I used command "last" and cut part of it. Thanks, I will update my question. – tonemap Mar 7 '14 at 14:38
1

X needs a tty device for the graphical display. Usually `/dev/ttyn where n is by convention a high one (tty6 or tty7 and also tty8 it appears).

To see this for yourself. You can type CTRL-SHIFT-F1 it is usually mapped to bring you out of graphical mode to an ascii console, F1 implies tty1. (F2 -> tty2 etc.)

Now you are back to a console device, you can change to the 2nd console device with just Alt-F2 for tty2 or Alt-F3 => tty3 and ALT-F8, would take you back into the X session on tty8.

So the entries you refer to look like an X login. Notice column 3 first shows first :0 and then :0.0 after the X display and X server have been set up.

Your first login was by root and then account was used. Would this have been after your installation? I'm not sure otherwise why there was a change to tty8, however it is configurable as to which tty-number is used for X, did you change that ? or Number of consoles to start ? If not maybe that changes as part of installation or upgrade.

I'm not using kali so can't check the specifics.

  • Thank you, X Tian! I haven't edited manually any configuration files, this is more or less default installation - I have only downloaded new programs. I tested switching accounts account > root > account: first it uses tty7, after log out new one is opened in tty8 and finally it gives you tty9. Everything works fine, but I don't know why there's an unknown entry before actual log in and usually at shutdown, and after log out it uses different console as described above. I will update the question with a better example of the log. – tonemap Mar 7 '14 at 17:17
  • Would that be the bit of X that provides the graphical login (can't remember what it's called), which it done logged-in as unknown, then having entered your details it logs out as unknown and logins in as your user. It might be done this way to highlight failed login attempts presumably, for security analysis? (Sorry I'm really guessing now, hoping a better X (wo)man might step in.) – X Tian Mar 7 '14 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.