Summarize the last and lastb commands in Linux environment

This article mainly shares with you a summary of the last and lastb commands in the Linux environment. It has a good reference value and I hope it will be helpful to everyone. Let’s follow the editor to take a look, I hope it can help everyone.

1. Background

This morning I saw an article about a server being cracked and used as a mining machine. In the article, I saw that the author used the lastb command to find the attacker's login history. I thought it was quite powerful, so I summarized the commands related to last and lastb.

2. Last command

1. Function:

The last command is used to display the user’s recent login information. Execute the last command alone, it will read the /var/log/wtmp file and display the list of all users logged into the system recorded in the file. Successful login information.

2. Command parameters:

-a：把从何处登入系统的主机名称或ip地址，显示在最后一行；
-d：将IP地址转换成主机名称；
-f <记录文件>：指定记录文件。
-n <显示列数>或-<显示列数>：设置列出名单的显示列数；
-R：不显示登入系统的主机名称或IP地址；
-x：显示系统关机，重新开机，以及执行等级的改变等信息。

3. Expression form

4. Explanation

第一列：用户名

        第二列：终端位置

        第三列：登录ip或者内核

        第四列：开始时间

        第五列：结束时间（still login in 还未退出  down 直到正常关机 crash 直到强制关机）

        第六列：持续时间

wtmp, btmp, and utmp are all binary files. They cannot be viewed with cat and can be opened with last.

2. lastb command

1. Function:

The Linux lastb command is used to list information about users who failed to log in to the system. Execute the lastb command alone, it will read the file named btmp located in the /var/log directory, and display all the login failed user lists recorded in the file.

2. Parameters

-a 　把从何处登入系统的主机名称或IP地址显示在最后一行。
-d 　将IP地址转换成主机名称。
-f<记录文件> 　指定记录文件。
-n<显示列数>或-<显示列数> 　设置列出名单的显示列数。
-R 　不显示登入系统的主机名称或IP地址。
-x 　显示系统关机，重新开机，以及执行等级的改变等信息。

3. Main log files under linux

1. 进程日志(acct/pacct: 记录用户命令)
2. 错误日志(/var/log/messages:系统级信息；access-log:记录HTTP/WEB的信息)
3. 连接日志(/var/log/wtmp,/var/log/btmp,/var/run/utmp)
>>>有关当前登录用户的信息记录在文件utmp中;
>>>登录进入和退出纪录在文件wtmp中;
>>>最后一次登录文件可以用lastlog命令察看;
>>>数据交换、关机和重起也记录在wtmp文件中;

3. How to clear user login Information

Since you can use last and other commands to view the records of successful logins, natural entrants can also use some means to clear these records.

1. Clear login success information

清除登陆系统成功的记录
[root@localhost root]# echo > /var/log/wtmp //此文件默认打开时乱码，可查到ip等信息
[root@localhost root]# last //此时即查不到用户登录信息

2. Clear login failure information

清除登陆系统失败的记录
[root@localhost root]# echo > /var/log/btmp //此文件默认打开时乱码，可查到登陆失败信息
[root@localhost root]# lastb //查不到登陆失败信息

3. Clear historical executed commands

清除历史执行命令
[root@localhost root]# history -c //清空历史执行命令
[root@localhost root]# echo > ./.bash_history //或清空用户目录下的这个文件即可

4. Import empty historical command files

导入空历史记录
[root@localhost root]# vi /root/history //新建记录文件
[root@localhost root]# history -c //清除记录
[root@localhost root]# history -r /root/history.txt //导入记录
[root@localhost root]# history //查询导入结果

Server security is also a top priority in daily development. I hope I can learn this aspect well. Although I haven’t been attacked yet, no one can predict what will happen in the future. Record it.

end

Related recommendations:
1. How to clear user login records and command history in Linux
2. In-depth understanding of last under Linux Commands and their data sources

The above is the detailed content of Summarize the last and lastb commands in Linux environment. For more information, please follow other related articles on the PHP Chinese website!