Re: user not showing up in 'last' (wtmp)

Your suspicion seems to have some merit, however, this list is generally for poptop, not pppd, and therefore, someone may know, but there is a much higher probability someone from the pppd team would know more.    If you don't hear much from anyone on this list, I suggest trying pppd team members or any associated lists/irc channels, etc.

~Phil



On Jun 2, 2012, at 5:08 AM, Tobias Skytte <[email protected]> wrote:

> Hi,
> 
> Sometimes users don't show up in the 'last' command although they usually do.
> 
> Usually the 'last' command gives something like this (usernames and IP addresses sanitized):
> 
> [santitized]# last
> root     pts/2        somewhere Sat Jun  2 12:50   still logged in   
> user1 ppp0         2.22.444.555    Sat Jun  2 10:55   still logged in   
> user2 ppp7         3.44.555.666      Sat Jun  2 09:05   still logged in   
> user3 ppp0         4.55.666.777      Sat Jun  2 08:49 - 09:18  (00:28)    
>  
> 
> But sometimes a user is simply not entered into this at all (or looses its entry). 
> When I check the messages file for this username I get a normal entry like this:
> 
> May 30 08:38:44 dk2 pppd[20678]: Plugin radius.so loaded.
> May 30 08:38:44 dk2 pppd[20678]: RADIUS plugin initialized.
> May 30 08:38:44 dk2 pppd[20678]: Plugin radattr.so loaded.
> May 30 08:38:44 dk2 pppd[20678]: RADATTR plugin initialized.
> May 30 08:38:44 dk2 pppd[20678]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
> May 30 08:38:44 dk2 pppd[20678]: pptpd-logwtmp: $Version$
> May 30 08:38:44 dk2 pppd[20678]: pppd 2.4.4 started by root, uid 0
> May 30 08:38:44 dk2 pppd[20678]: Using interface ppp4
> May 30 08:38:44 dk2 pppd[20678]: Connect: ppp4 <--> /dev/pts/5
> May 30 08:38:47 dk2 pppd[20678]: Unsupported protocol 'IPv6 Control Protovol' (0x8057) received
> May 30 08:38:47 dk2 pppd[20678]: MPPE 128-bit stateless compression enabled
> May 30 08:38:49 dk2 pppd[20678]: Cannot determine ethernet address for proxy ARP
> May 30 08:38:49 dk2 pppd[20678]: local  IP address 10.5.1.1
> May 30 08:38:49 dk2 pppd[20678]: remote IP address 10.5.1.6
> May 30 08:38:49 dk2 pppd[20678]: pptpd-logwtmp.so ip-up ppp4 user4 111.222.333.444
>  
> Then I check the ppp4 interface which is up and looks normal. 
> Also the pppd process 20678 is running. 
> And when I tcpdump the interface (ppp4) then I can see trafic. So obviously the user is still connected. 
> HOWEVER: When I ping the remote IP (10.5.1.6) then I get no response (I normally get a response from remote addresses). Not sure if this has any impact.
> 
> 
> Anybody know why this user is not logged in the wtmp file?
> I guess it's the pptpd-logwtmp.so plugin that is failing, but have others experienced this?
> 
> 
> Regards,
> Tobias
> 
> 
> 
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Poptop-server mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/poptop-server

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server