2

Why do I need to have elevated permissions to access the last failed logins (/var/log/btmp) but not for the last successfull logins (/var/log/wtmp). (At least per default on debian/ubuntu linux - my system: debian 9)

Are there any security considerations?

Basically I would like to run lastb on every login and thus set read permission for all users chmod o+r /var/log/btmp. Any contradictions?

1

Read access to that log is a way for (local) attackers to access account passwords in cleartext, because (according to the OpenSSH people) the most common failure mode for login is when the user accidentally types the password at the prompt for the account name.

Further reading

  • "failure mode for login is when the user accidentally types the password" so obvious, I didn't think about it. Thanks for the links! – eli Jul 26 '18 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.