Last login missing

From: Milos Prudek (prudek_at_bvx.cz)
Date: 07/01/04

  • Next message: Toni Heinonen: "RE: Last login missing" 
    Date: Thu, 01 Jul 2004 10:59:53 +0200
To: focus-linux@securityfocus.com

    If "Last login:" is not displayed, is that fishy? Is it a sure
    indication that a cracker was there and cleaned up his tracks?

    Details:

    When I connect via ssh to my linux server it always displays Last login:
    <date> from <host>

    Today I received a suspiciously looking email from my server about an
    unexpected restart of Apache, so I logged in and there was no "Last
    login:" information.

    Of course when I logged in again, "Last login:" information was there
    just fine. 

    -- 
Milos
  • Next message: Toni Heinonen: "RE: Last login missing"