From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1RyVX0-0007CB-2i for garchives@archives.gentoo.org; Fri, 17 Feb 2012 21:39:55 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6BBCFE080D; Fri, 17 Feb 2012 21:39:43 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id D1AAAE092A for ; Fri, 17 Feb 2012 21:38:05 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp.gentoo.org (Postfix) with ESMTP id 5BF471B4017 for ; Fri, 17 Feb 2012 21:38:05 +0000 (UTC) X-Virus-Scanned: by amavisd-new using ClamAV at gentoo.org X-Spam-Flag: NO X-Spam-Score: -2.204 X-Spam-Level: X-Spam-Status: No, score=-2.204 tagged_above=-999 required=5.5 tests=[AWL=-0.295, BAYES_00=-1.9, FSL_RCVD_USER=0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from smtp.gentoo.org ([127.0.0.1]) by localhost (smtp.gentoo.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lqyd0rRzb2D1 for ; Fri, 17 Feb 2012 21:37:59 +0000 (UTC) Received: from filth.tisys.org (filth.tisys.org [46.4.74.76]) by smtp.gentoo.org (Postfix) with ESMTP id CE00D1B4008 for ; Fri, 17 Feb 2012 21:37:55 +0000 (UTC) Received: from eee1215n.fritz.box (dslb-088-070-029-186.pools.arcor-ip.net [88.70.29.186]) (authenticated bits=0) by filth.tisys.org (8.14.4/8.14.4) with ESMTP id q1HLfSqd027537 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 17 Feb 2012 22:41:30 +0100 Date: Fri, 17 Feb 2012 22:37:35 +0100 From: Nils Holland To: gentoo-user@lists.gentoo.org Subject: [gentoo-user] PAM and utmp Message-ID: <20120217213735.GA3952@eee1215n.fritz.box> Mail-Followup-To: gentoo-user@gentoo.org Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Organization: Ti Systems, Wunstorf-Luthe, Germany X-Operating-System: Linux eee1215n 3.2.1-gentoo User-Agent: Mutt/1.5.21 (2010-09-15) X-Archives-Salt: 14fb29fb-ab94-45bc-b1cb-7274779a4d00 X-Archives-Hash: d0e2a8d949f74d6042d218dc48386b8e Hi folks, well, I did some searches on this already, but without success, so I thought I'd ask here. Following issue: I have the strong feeling that my ~x86 Gentoo box no longer seems to record "local" logins into /var/run/utmp. When I use screen or login via ssh, everything works fine, but I can do millions of local, non-X11 plain vanilla terminal logins without ever seeing anything when running "who" or "w". And I have the feeling that this used to work in the past. Now, what do I know, I tried to trace the problem down a bit. My /var/run/utmp seems absolutely fine structure- and permission-wise. So I had a look at the sources of /bin/login, because I believed that this little guy actually writes to utmp entry when I login. That assumption seemed to be wrong, however, since in cases where PAM is used (which is the case here), /bin/login no longer seems to be responsible for that, but instead it is handled by PAM. At least it looks so in the source. Interestingly, I found a man page for the PAM module "pam_lastlog.so" on the web which states that this modul would create the utmp entry. The pam_lastlog man page on my local system only mentions /var/log/lastlog and wtmp - nothing about utmp. So ... I have pam_lastlog in use here but it in fact doesn't seem to make a difference utmp-wise. Is it possible that the module *used* to do utmp stuff but no longer does today? Some further searching revealed another PAM module called "pam_loginuid", which, according to its man page, "sets the loginuid process attribute for the process that was authenticated" and should be used for "entry point applications like login". Aha. Tried that. Didn't seem to do anything. Now I really wonder who on earth is really responsible to record my login this days. ;-) Am I the only thing seeing this, or can somebody confirm this? Any hints would be greatly appreciated! Thanks and greetings, Nils -- Nils Holland * Ti Systems, Wunstorf-Luthe (Germany) Our Gentoo mirror: http://rush.tisys.org/ (IPv4 + IPv6) Powered by GNU/Linux since 1998