How to Read /var/log/btmp, Rotate the btmp Log With Logrotate

26 Comments

1. Thanks. my btmp has filled up my server.

   Need to do some emergency delete of that file.
   * Is it ok just to delete it?
   I suspect not.
   if not is there a linux command that says:
   # “empty files contents but do not delete it”

   Also would be handy to be able to simply block access from the ip that is doing the attempts. i feel like a sitting duck watching the same ip trying each variation of paswords on my mail accounts.

   Can i set something somewhere that says “If IP address xyz attempts to connect in anyway to this machine …say no”

    Reply

   • Hello anon,

     You can set it up to rotate the file, then run logrotate immediately, and then delete the rotated file. I would suggest rotating it out first and then deleting the rotated file.

     Hope that helps.
     Thanks.
     alex

      Reply

2. Noticed the same thing on my server, looks like contents are not so clear though. Wonder what the differences between btmp and secure are.

   @anon, you can probably do an:
   echo “” > /var/log/btmp
   to keep the file there and clear the contents.

   Blocking brute force IPs is probably a good idea, there is a nice python deamon that automatically does this, parsing from /var/log/secure, called denyhosts.

    Reply

   • Hello Justin,

     Great. Thanks for the extra info.

     Thanks.
     alex

      Reply

3. Great article, very informative.

   Thank You

    Reply

   • Hello Aditya,

     No problem. Thanks for taking the time to leave feedback.

     Thanks.
     alex

      Reply

4. just a note you can also use the lastb command in lieu of last, which assumes the btmp log file

   so

   lastb

   is the equivalent to

   last -f /var/log/btmp

    Reply

   • Hello jalama,

     Thanks for taking the time to note that!

     Thanks.
     alex

      Reply

5. NP

   One of my staff whipped together to get a count by IP address, it’s slightly flawed (we’re okay at shell commands but not masters) but effective.

   sudo last -f /var/log/btmp | sed ‘s/^[A-Za-z0-9]* *[A-Za-z:]* *\([A-Za-z0-9\.]*\) .*$/\1/’|sort|uniq -c|sort -k 1,1 -r

    Reply

   • Hello jalama,

     Cool. I checked it out and it worked without issue. Anyone else using the above command from jalama you may need to change the quotes as they show up different sometimes when displayed in a browser.

     Thanks again for providing!

     Thanks.
     alex

      Reply

6. I used the following

   last -f btmp | awk ‘{print $3}’ | sort | uniq -c | sort -n

   Just a little cleaner since the output of last is fixed.

    Reply

   • Hello Ryan,

     Thanks for taking the time to share!

     Thanks.
     alex

      Reply

7. Hi Alex, my server gets attacked on a regular basis. Once a week the server falls over and the BMTP file goes in to the Gigabyte range ;-(
   Thanks to this I have got it rotated.
   I’m so green when it comes to Linux.
   I know I have IP Tables installed so next step is to learn it. Is there a quick and dirty tutorial? I simply want to turn it on, add some of these IP address and sigh with relief.
   I have a virtual server with a Plesk control panel.
   Thanks for setting this page up.
   Graham

    Reply

   • Hello Graham,

     To minimize the traffic to the SSH port you could simply change the port that SSH is listening on. This will minimize brute force attempts and cut the size of the log files. As for iptables I am not sure of a tutorial right off though I am sure they are out there. Just make sure when implemented that you test every portion of your server that needs to be accessed remotely as it is easy to accidently shutdown a needed service without realizing it.

     Thanks.
     alex

      Reply

     • Hi Alex. Thanks for replying

       If I did this is there any potential of locking myself out of the server?

       I use putty to access the server so is all I have to do is change the port on the server and in putty?

       Will anything else be affected by this port change?

       Thanks,
       Graham

        Reply

       • For instance I also use WinSCP (SFPT client) Would this be affected?

         Also, it appears there are 2 ways to change the port.

         1) Edit the file /etc/ssh/sshd_config and chaneg the line “#Port 22” to what ever Port I desire

         2) Create a file in /etc/xinetd.d/sshd and populate with following…

         service ssh
         {
         disable = no
         socket_type = stream
         type = UNLISTED
         port = 22
         protocol = tcp
         wait = no
         user = root
         server = /usr/sbin/sshd
         server_args = -i
         }

         Sorry I’m so new to Linux.
         Which one would be best and would restarting the server after implementing one of these methods be enough to initialize the new port number?
         Thanks for your help.
         Graham

          Reply

         • OK I did it. and it worked….
           I edited file /etc/ssh/sshd_config and changed the port number and restarted the server.
           Bingo.
           Hopefully no more brute force attacks.

         • Hello Graham,

           Good to hear! Thanks for taking the time to follow up and let us know it was successful.

           Thanks.
           alex

         • Don’t reboot since if anything is wrong you might not be able to get in again, just restart sshd and try it out by setting up a new session while still keeping your old session.

           /etc/init.d/sshd reload

           —

8. I wrote this one line script a long time ago, called firewall

   /sbin/iptables -A INPUT -p tcp -s $1 -j REJECT –reject-with tcp-reset

   so I run it like this – quick and easy

   firewall 218.25.XXX.20

   I rarely use it now, because I use CPANEL brute force protection that does it automatically.
   But that IP up there has tried to connect 41,000 times since the log rolled over, so he’s permanently blocked now.

    Reply

   • Hello Alan,

     Good deal, thanks for taking the time to share.

     Thanks.
     alex

      Reply

9. Use fail2ban to automatically add bad ssh clients to your IPTables. Highly configurable and purges old entries automatically.

   I also run denyhosts to proactively block bad clients on the internet. Uses a centralized list that you can upload your contribution to improve. It uses /etc/hosts.deny instead of IPTables.

   Belt and suspenders.

    Reply

   • Hello LinuxNinja,

     Did you used to hang out on Dalnet in #linuxpeople? If so this is dakykilla from back then…

     Thanks.
     alex

      Reply

10. I’m interested what Alan’s line of code does. (couple of posts above)
    Can any one explain what this line does?

    /sbin/iptables -A INPUT -p tcp -s $1 -j REJECT –reject-with tcp-reset

     Reply

11. hi Karel, Alan’s line is just an easy script to add an IP address that he wishes to block to the Input chain of iptables. (so you need iptables running). so, with it, the ip address used with the script will have all of it’s traffic rejected.

     Reply

12. Amazing stuff…helped me in my semester exam’s preperation. Thanks!!

     Reply