2

TLDR: How is useradd --no-log-init actually used [in GNU/Linux [Debian]?

I read the command's man and info page about this option as: »user will not be listed in the lastlog and faillog files ⁄ output«. I know that the PAM module took over most of the actual login work. I understand the lastlog and the faillog commands, and I'm aware that via the latter e.g. the number of login attempts and such can be set.

I also know that bad login attempts are recorded in /var/log/utmp. This strengthens my suspicion that this command is »leftover« from back then before PAM module took over the job.

1

If you look at the useradd.c source there is this bit that shows the following.

Assuming the command line switch --no-log-init was set, the faillog_reset and lastlog_reset functions are called:

if ((!lflg) && (getpwuid (user_id) == NULL)) {
                 faillog_reset (user_id);
                 lastlog_reset (user_id);

When lastlog_reset is called this bit will modify the lastlog file:

     fd = open (LASTLOG_FILE, O_RDWR);
     if (   (-1 == fd)
         || (lseek (fd, offset_uid, SEEK_SET) != offset_uid)
         || (write (fd, &ll, sizeof (ll)) != (ssize_t) sizeof (ll))
         || (fsync (fd) != 0)
         || (close (fd) != 0)) {

The above shows the file lastlog being opened for read & write (O_RDWR) followed by a if statement that makes sure the file was opened successfully followed by a seek within the file to a location and a write of the new user's info to the file. Afterwards the file is closed.

Based on this I would assume that that option controls whehter a user's UID is added to the lastlog "database" file and nothing more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.