0

I maintain a Debian multipurpose server and I'm the sole admin. I execute the lastcommand every time I ssh into the server to check if I recognize every user who have used its service and if they're allowed. I of course made my own custom security modifications to it in order to make it secure over the Internet.

Last night I executed the command and found out that the log had completely been erased and there were no entries of any users on the server. When I run last, there's usually an output of over 15 lines of who used the system but this time there's only one which was myself. I've only started using last for about a few months. I read the man page for it but it didn't say anything about it reseting itself after some x amount of time. Is it possible that my server has been hacked?? The only way to legally access this server is through my own private openvpn server.

  • Also look at the lastlog command; this doesn't record all login/logout/reboot stuff that wtmp records, but it does record the last login time for each user. Note, though, that in both cases a non-interactive login may not show up (ssh remotehost cat myfile doesn't necessarily count as a login!) – Stephen Harris Aug 4 '16 at 0:43
4

It resets when the data file is erased, e.g., a monthly task on many computers. last reads wtmp. On systems which do this, it is common to rename the existing wtmp to retain it (for a while), and you can read that file using last by giving the -f option with the corresponding filename.

Further reading:

  • Thanks for your timely answer. Very informative, and I'm glad to know that someone did not intentionally erase it. – answerSeeker Aug 3 '16 at 23:59
  • No problem. On some systems, it "never" is erased, while on others it is - monthly. – Thomas Dickey Aug 4 '16 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.