1

I've noticed that unlike most logs, /var/log/auth.log isn't world-readable. What sensitive data is logged to auth.log that would make it have these more-restricted permissions? (I'm trying to determine if making it world-readable is safe). This is on Ubuntu 14.

2

It contains logs of all connections, which can be considered private information, at least on a multi-user system: it’s only the administrator’s business to know when and how the users log in to a system (and even that knowledge needs careful consideration). As Giacomo Catenazzi points out though, there are other ways of obtaining this information, which by default aren’t restricted.

More importantly perhaps, it also contains logs of sudo commands, which could easily contain sensitive information (and is also one of the reasons you should avoid specifying passwords on command lines). Again on a multi-user system, the administrator probably doesn’t want all the users to be able to see everything that’s done with sudo...

Note that this is just the default auth.log setup, and as with any aspect of logging, system administrators can reconfigure it any way they want.

  • but "last" command gives us enough information for all uses [point #1] – Giacomo Catenazzi Dec 8 '17 at 14:12
2

Because often it included the password of users. It is not infrequent to write the password in the login field, so by reading the auth.log, one could find the password of some users (they will login after such failed attempt, so both login and password is available).

This is was I learned 20 years ago. Now also the second point of @StephenKitt's answer is valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.