[systemd-devel] lastlog and friends

[Karel Zak]

On Tue, Jul 29, 2014 at 09:28:42PM +0200, Lennart Poettering wrote:
> On Tue, 29.07.14 14:43, Karel Zak (kzak at redhat.com) wrote:
> 
> > 
> > 
> >  systemd TODO:
> > 
> >     - Replace utmp, wtmp, btmp, and lastlog completely with journal
> > 
> > 
> >  Can someone elaborate and provide more details, ideas, .. ?
> 
> Basically, we just want to have a nice tool that can dump data similar
> to "lastlog" or "last" to stdout, originating from the journal.

in util-linux 2.25 (f21, and backported to rhel6 and rhel7) we have
introduced "lslogins". It's mostly motived by requests from classic
admis (RH customers) who after migration to Linux complains that all
unixes have "logins" command.

It's designed like lsblk(8), so it's easy to extend, and it's possible
add another sources for data. Now it reads info from libc
(getpwent()), utmp, wtmp, lastlog and also from journal to get last
user's messages.

$ sudo ./lslogins kzak
m
Username:                           kzak                                
UID:                                1000                                
Gecos field:                        Karel Zak,Home Office,123           
Home directory:                     /home/kzak                          
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 no                                  
Password not required:              no                                  
Login by password disabled:         no                                  
Primary group:                      kzak                                
GID:                                1000                                
Supplementary groups:               test,mock                           
Supplementary group IDs:            1001,988                            
Last login:                         Jul29/09:30                         
Last terminal:                      pts/5                               
Last hostname:                      localhost                           
Failed login:                       Jul29/18:22                         
Failed login terminal:              :0                                  
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   2013-Jan16                          
Maximum change time:                99999                               
Running processes:                  51                                  

Last logs:
Jul 30 09:35:01 gnome-session[1516]:and actually has type UTF8_STRING format 8 n_items 0.
Jul 30 09:35:01 gnome-session[1516]:This is most likely an application bug, not a window manager bug.
Jul 30 09:35:01 gnome-session[1516]:The window has title="mutt" class="terminology" name="mutt"


$ sudo ./lslogins --system-accs
UID USER           PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS
988 uuidd             0        0        1            UUID generator helper daemon
989 geoclue           0        0        1            User for geoclue
990 unbound           0        0        1            Unbound DNS resolver
991 lightdm           0        0        1            
992 nm-openconnect    0        0        1            NetworkManager user for OpenConnect
993 openvpn           0        0        1            OpenVPN
994 radvd             0        0        1            radvd user
995 pulse             0        0        1            PulseAudio System Daemon
996 colord            1        0        1            User for colord
997 chrony            1        0        1            
998 saslauth          0        0        1            "Saslauthd user"
999 polkitd           1        0        1            User for polkitd

etc..

> >  The current lastlog is sparse file and it's difficult to use for backup 
> >  programs or integrity checkers, etc. So requests from users/customers
> >  are pretty common.
> >  
> >  The idea (from someone from RH) is to have very simple and tiny
> >  library that provides unified API for different backends (classic
> >  lastlog, systemd journal, etc.) to keep applications portable.
> >  Something like:
> > 
> >    https://github.com/marmolak/liblastlog2
> > 
> >  Frankly, I'd like to see something more than only lastlog, but also
> >  utmp, wtmp support.
> 
> Honestly, this sounds like something awfully peripheral to deserve a
> library of its own. 

Yes, I have many doubts too... 

> Also, a library whose primary purpose is to be abstraction glue to
> support one backend that is supposed to be the backend of the future and
> one that is really something that should go away sounds like a bad
> idea. I mean, what would the benefit be?  Eventually people should just

The primary goal for the library was to replace the current ugly lastlog
file format with a better format.

    Karel

-- 
 Karel Zak  <kzak at redhat.com>
 http://karelzak.blogspot.com