Mailinglist Archive: opensuse-security (757 mails)

< Previous Next >
Re: [suse-security] /var/log/wtmp hacked or not?
Il 20:01, giovedì 24 gennaio 2002, Benedikt Wilbertz ha scritto:
> While monitoring /var/log/wtmp with tail -f, I discovered, that the use
> of netdate added some strange characters to that file,
> which could lead to such an corrupted output of last.
> I tested it on SuSE 7.2, 2.2.19 with the netdate.rpm of both, SuSE 7.2
> and 7.3.
> Perhaps anyone can confirm this discovery.
> Benedikt Wilbertz

Yes, it's happening here too. I am using Suse 7.1 with Kernel 2.4.16, but it
was the same with older kernels.
I also have noticed that when I try last just after netdate, the output is
almost empty (ie, it reports only the time when wtmp starts is reported).
Btw, it gets back if I login after netdate.
So it looks there must be a bug in netdate after all!


< Previous Next >
Follow Ups