thkukuk / lastlog2

Y2038 safe version of lastlog

lastlog2

Y2038 safe version of lastlog

lastlog2 got merged with util-linux 2.40

lastlog2 got merged with util-linux 2.40. With this, this project stopped and got archived. Please use lastlog2 from util-linux.

Background

lastlog reports the last login of a given user or of all users who did ever login on a system.

The standard /var/log/lastlog implementation using lastlog.h from glibc uses a 32bit time_t in struct lastlog on bi-arch systems like x86-64 (so which can execute 64bit and 32bit binaries). So even if you have a pure 64bit system, on many architectures using glibc you have a Y2038 problem.

For background on the Y2038 problem (32bit time_t counter will overflow) I suggest to start with the wikipedia Year 2038 problem article.

There is also a more technical document, describing the problem in more detail, which also contains a list of affected packages. And a more highlevel blog "Y2038, glibc and /var/log/lastlog on 64bit architectures"

Additional, /var/log/lastlog can become really huge if there are big UIDs in use on the system. Since it is a sparse file, this is normally not a problem, but depending on the filesystem or the tools used for backup, this can become a real problem.

Since there are only few applications which really support lastlog, the data is also not always correct.

lastlog2

lastlog2 tries to solve this problems:

• It's using sqlite3 as database backend.
• Data is only collected via a PAM module, so that every tools can make use of it, without modifying existing packages.
• The output is as compatible as possible with the old lastlog implementation.
• The old /var/log/lastlog file can be imported into the new database.
• The size of the database depends on the amount of users, not how big the biggest UID is.

IMPORTANT To be Y2038 safe on 32bit architectures, the binaries needs to be build with a 64bit time_t. This should be the standard on 64bit architectures.

The package constists of a library, PAM module and an application:

• liblastlog2.so.0 contains all high level functions to manage the data.
• pam_lastlog2.so shows the last login of a user and stores the new login into the database.
• lastlog2 will display the last logins for all users, who did ever login.

By default the database will be written as /var/lib/lastlog/lastlog2.db.

Configuration

The pam_lastlog2.so module will be added in the session section of the service, which should display the last login message and store the new data. On openSUSE Tumbleweed and MicroOS, the following line needs be added to /etc/pam.d/postlogin-session:

session optional pam_lastlog2.so

This line will create a new entry in the database for every user if an application calls the PAM framework.

lastlog2's Issues

Use bind

lastlog2/lib/lastlog2.c

Line 184 in 6a3244c

"REPLACE INTO Lastlog VALUES('%s', %llu, '%s', '%s');",

lastlog2/lib/lastlog2.c

Line 326 in 6a3244c

if (asprintf (&sql, "DELETE FROM Lastlog WHERE Name = '%s';", user) < 0)

You don't do proper escaping here. Use prepare-bind-step as in other places. While neither Name, nor TTY, nor RemoteHost can contain ' or \, for future, it's definitely ,more bulletproof.

static sqlite makes the library way too big

hi,

since i use lastlog in my embedded firmware, i thought maybe looking ahead would be helpful.

however using sqlite is prohibitive as it adds another megabyte i cannot afford to my build.

when i try to link statically, as you'd imagine, the shared library blows up to ~1.1M since it needs a lot of the calls from sqlite.

GagansMacPro:router Gagan$ mips64el-none-linux-gnu-strip mipsel/install/lastlog2/usr/lib/*
mips64el-none-linux-gnu-strip: Warning: 'mipsel/install/lastlog2/usr/lib/pkgconfig' is a directory
mips64el-none-linux-gnu-strip: Warning: 'mipsel/install/lastlog2/usr/lib/systemd' is a directory
mips64el-none-linux-gnu-strip: Warning: 'mipsel/install/lastlog2/usr/lib/tmpfiles.d' is a directory
GagansMacPro:router Gagan$ ls -lh mipsel/install/lastlog2/usr/lib/
total 1.1M
lrwxr-xr-x 1 Gagan staff   16 May  9 15:02 liblastlog2.so -> liblastlog2.so.1
lrwxr-xr-x 1 Gagan staff   20 May  9 15:02 liblastlog2.so.1 -> liblastlog2.so.1.1.0
-rwxr-xr-x 1 Gagan staff 1.1M May  9 15:02 liblastlog2.so.1.1.0
drwxr-xr-x 2 Gagan staff  102 May  9 15:02 pkgconfig
drwxr-xr-x 3 Gagan staff  102 May  9 15:02 systemd
drwxr-xr-x 2 Gagan staff  102 May  9 15:02 tmpfiles.d

is there any way i can use lastlog2 while keeping the size down?

Use STRICT tables

lastlog2/lib/lastlog2.c

Line 183 in 6a3244c

if (asprintf (&sql, "CREATE TABLE IF NOT EXISTS Lastlog(Name TEXT PRIMARY KEY, Time INT, TTY TEXT, RemoteHost TEXT);"

Append STRICT at the end of CREATE TABLE. This might save you a lot of pain -- the types are really what they are supposed to be. That means you have to switch from INT to INTEGER too.

Should be TIME updated by a TRIGGER (unlikely as you set the time from stat AFAICS) and have a default value of CURRENT_TIMESTAMP?

Also I would expect NOT NULL in some columns. I suppose, UNIQUE is only the name and that is by default via PRIMARY KEY.