Re: user not showing up in 'last' (wtmp)

G'day Tobias,

Yes, your problem looks interesting.  I seem to be the author of the
pptpd-logwtmp plugin, and I think it is only included within the pptpd
sources, so this mailing list is probably the correct one initially.

However, as you have already determined, the plugin is being called,
and so the logwtmp(3) function is being called, yet last(1) is showing
incorrect output.

The plugin code is very straightforward; it sends to the logs the line
you quoted:

> May 30 08:38:49 dk2 pppd[20678]: pptpd-logwtmp.so ip-up ppp4 user4
> 111.222.333.444

... and immediate afterwards it calls logwtmp with the exact three
string arguments "ppp4", "user4", "111.222.333.444"

The problem can be redefined as "last(1) is not showing correct output
after logwtmp(3) is called", and you can work with the kernel, library
(libutil), or utilities (last) folk at your chosen distribution.

The function looks like this:

static void ip_up(void *opaque, int arg)
{
  char *user = reduce(peer_authname);
  if (debug)
    notice("pptpd-logwtmp.so ip-up %s %s %s", ifname, user, 
           pptpd_original_ip);
  logwtmp(ifname, user, pptpd_original_ip);
}

I note that the logwtmp(3) function has no status return.  Our plugin
cannot determine if logwtmp(3) was successful.

My guess is that logwtmp(3) is not resilient in the face of
simultaneous login attempts, with one attempt overwriting the other.

-- 
James Cameron
http://quozl.linux.org.au/

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/