Login history¶
These are binary files read with dedicated tools:
| File | Contents | Tool |
|---|---|---|
/var/log/wtmp |
Successful logins, logouts, reboots | last, last -x, last reboot |
/var/log/btmp |
Failed login attempts | sudo lastb |
/var/log/lastlog |
Last login per user | lastlog, lastlog -u andrew |
/run/utmp |
Currently logged-in sessions | who, w |
last -F -n 20 # last 20 logins with full timestamps
last -x shutdown reboot # reboots and shutdowns
sudo lastb -n 50 # failed attempts
Newer distributions are moving these to SQLite-based replacements (wtmpdb, lastlog2) to fix the 2038 timestamp problem. The commands are similar (wtmpdb last, lastlog2).
auditd¶
The Linux audit framework records security-relevant kernel events (file access, syscalls, privilege changes, logins) independently of syslog, in /var/log/audit/audit.log. It's what compliance frameworks (PCI-DSS, CIS, STIG) usually expect.
sudo systemctl enable --now auditd # package: audit (RHEL) / auditd (Debian)
sudo auditctl -s # status
sudo auditctl -l # loaded rules
Persistent rules go in /etc/audit/rules.d/*.rules:
# /etc/audit/rules.d/50-local.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd_config
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=unset -k root_cmds
sudo augenrules --load
sudo ausearch -k identity -i --start today # -i interprets UIDs/syscalls
sudo ausearch -m USER_LOGIN --success no -i
sudo aureport --summary
sudo aureport --auth --failed
sudo aureport -x --summary # executables
Rotation is handled by auditd itself (max_log_file, num_logs, max_log_file_action = ROTATE in /etc/audit/auditd.conf), not logrotate. To get audit events into syslog for shipping, enable the syslog plugin in /etc/audit/plugins.d/syslog.conf (active = yes).