Very Computer

I want to know if there is some code out there that allows you to parse
through the wtmp entries (and utmp if it's the same format) and delete or
add entries at will.  If so, please mail it to me (and post it, as others
may be interested) with comments if possible.  

Thanks!

Peter
--
Peter Beckman                     Independent Consultant

: I want to know if there is some code out there that allows you to parse
: through the wtmp entries (and utmp if it's the same format) and delete or
: add entries at will.  If so, please mail it to me (and post it, as others
: may be interested) with comments if possible.  

if you have write access to utmp, it's not difficult... it's a sequential
file of fixed length records of type struct utmp... man utmp to see
it's makeup...

andru

[I trimmed the newsgroup list quite a bit, but it is still long..]

        getutent(), getutid(),  getutline(),  pututline(),  setutent(),
        endutent(), utmpname() - access utmp file entry

        #include <utmp.h>

Check the man page under: getut

--
"It was our last, best hope for peace -- it failed.       | Scott G. Hall
Now it's our last best hope." (Babylon-5 opener)          | Lucent Technologies
----------------------------------------------------------| Bell Labs - BCS

To clean all old entrys from wtmp , copy utmp to wtmp.  

--
--

UAB/Z/IP, Unix Systems Mgmt       Phone: +46 8 7274183
Ericsson AXE Research and Development, Armborstv 14,  S-125 25 Alvsjo, Sweden
--

            My opinions; I do not speak for my employer.

I have written programs in C, that remove the desired entries from the utmp and wtmp files.  If you want a copy of the same, email me.

bye
. . . . .

Ajay

        Do an alta vista search for "cloak.c" which has code
for clearing utmp and wtmp entries.

mjr.
--
Chief Scientist, V-ONE Corporation  --  "Security for a connected world"
work            http://www.v-one.com
personal        http://www.clark.net/pub/mjr/mjr-top.html

Quote:>    Do an alta vista search for "cloak.c" which has code
>for clearing utmp and wtmp entries.
>mjr.
>--
>Chief Scientist, V-ONE Corporation  --  "Security for a connected world"
>work            http://www.v-one.com
>personal        http://www.clark.net/pub/mjr/mjr-top.html

rick

#include <stdio.h>
#include <fcntl.h>
#include <utmpx.h>
#include <utmp.h>
#include <lastlog.h>
#include <pwd.h>

void kill_tmp(char *, char *);
void kill_tmpx(char *, char *);
void kill_lastlog(char *, char *);

int f;
char buf[40];

main(int argc, char **argv)
{

        if (argc!=2)
        {
                puts("Error!");
                exit(1);
        }

        kill_tmp(UTMP_FILE,*(argv +1));
        kill_tmp(WTMP_FILE,*(argv +1));
        kill_tmpx(UTMPX_FILE,*(argv +1));
        kill_tmpx(WTMPX_FILE,*(argv +1));
        kill_lastlog("/var/adm/lastlog",*(argv +1));

Quote:}

        if ((f=open(name,O_RDWR))>=0)
        {
                while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
                        if (!strncmp(utmp_ent.ut_name,who,strlen(who)))
                        {
                                bzero((char *)&utmp_ent,sizeof( utmp_ent ));
                                lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
                                write (f, &utmp_ent, sizeof (utmp_ent));
                        }
                close(f);
        }
        else
        {
                sprintf(buf,"write %s",name);
                perror(buf);
        }

Quote:}

        if ((f=open(name,O_RDWR))>=0)
        {      
                while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
                        if (!strncmp(utmp_ent.ut_user,who,strlen(who)))
                        {
                                bzero((char *)&utmp_ent,sizeof( utmp_ent ));
                                lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
                                write (f, &utmp_ent, sizeof (utmp_ent));
                        }
                close(f);
        }
        else
        {
                sprintf(buf,"write %s",name);
                perror(buf);
        }

Quote:}

        if ((pwd=getpwnam(who))==NULL)
        {
                printf("Can't get user info for %s in /etc/passwd\n",who);
                printf("lastlog not changed.\n");
                return;
        }
        if ((f=open(name, O_RDWR)) >= 0)
        {
                lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
                bzero((char *)&newll,sizeof( newll ));
                write(f, (char *)&newll, sizeof( newll ));
                close(f);
        }
        else
        {
                sprintf(buf,"write %s",name);
                perror(buf);
        }

Quote:}

Quote:

> The following is for Solaris2.  It takes a username as an argument and
> removes all entries from [uw]tmp [uw]tmpx and lastlog.  

> rick

-Wes

Quote:>that I had ever been on the system.  After entering "Zap UserName", the
>program took all records in utmp, wtmp, and lastlog so it looked like
>UserName had "Never Logged In".

There's no magic in any of this. This information is stored in regular
files. The world doesn't end if you write to one of them.

--
-----------------------------------------------------------------------------
Thomas Ptacek at The rdist Organization,
Chicagoland's only kung-fu guerilla terrorist computer security organization.

"If you're so special, why aren't you dead?"

Here is the site for the Zap.c program I mentioned that removes logged
entries from utmp, wtmp, and lastlog.  It is very easy to modify to just
remove all logged entries from any one of the three logs.

-Wes

--

2 rules to success in life:  1. Don't tell people everything you know.

        ftp://ftp.infonexus.com/pub/SourceAndShell/LogCleaners/UtmpAndWtmp/ma...

--

`da guild

#!/usr/local/bin/perl -w

# open(FH, '+< /var/log/wtmp');
open(FH, '+< /var/run/utmp');

my $entry = '';
while (read(FH, $entry, 36))
{
        my ($line, $name, $host, $time);
        ($line, $name, $host, $time) = unpack("a8 a8 a16 L", $entry);

        $_ = $name;
        if (m/gary/)
        {
                seek(FH, -36, 1);
                print FH "\0"x36;
                seek(FH,0,1);
        }

Quote:}

GREG