utmp/wtmp/btmp/lastlog

[matt335672]

I've been looking at #1077, #1302, @moobyfr's wtmp branch and other issues relating to utmp, wtmp and lastlog. We don't currently support these files directly, but some users have a requirement for them to be maintained by xrdp.

This seems to be a fairly complex area, made more complicated by potential Y2038 issues. Regarding the last @thkukuk has written extensively about this - see https://www.thkukuk.de/blog/Y2038_glibc_lastlog_64bit/ and also https://github.com/thkukuk/utmpx/blob/main/Y2038.md

The situation as I see it regarding xrdp is as follows:-

• On systems with Linux-PAM, lastlog and wtmp support can be added via pam_lastlog.so. OpenSUSE can use pam_lastlog2.so instead
• FreeBSD has its UTX database which replaces all of the above. It is supported via the FreeBSD pam_lastlog module

I haven't considered any other possible platforms.

Questions I have are:-

1. Are people happy to maximise use of PAM (of whatever flavour) to support wtmp/lastlog (or UTX)? Personally I can't see a reason not to go down this route, but others may see one.
2. Should we provide utmp support in code in xrdp at least in the short term to support Linux utilities which currently read this? My own thinking is that at the moment the answer to this is 'yes'.
3. Should we provide btmp support in code in xrdp? I think this is definitely a 'no'. There has been no mention of this in any of our issues or PRs.

Thanks for any feedback.

[thkukuk]

Some comments:

• Linux-PAM deprecated pam_lastlog.so, does not build it by default anymore and will remove it with one of the next releases (https://github.com/linux-pam/linux-pam/releases/tag/v1.5.3). pam_lastlog2 and pam_wtmpdb are recommended as replacement.
• util-linux will replace lastlog with lastlog2: lslogins: Add support for lastlog2 (#2088) util-linux/util-linux#2164 (comment) So the pam_lastlog2.so module will be widely adopted by the big Linux distributions.
• shadow will disable lastlog per default: https://ikerexxe.github.io/idm/2023/06/14/Y2038-problem-in-shadow.html

About PAM: are there still distributions not using PAM? With some exceptions mainly for openssh, all plans to solve the Y2038 problem for utmp/wtmp/lastlog are based on PAM.
About wtmp: openSUSE switched already to wtmpdb (pam_wtmpdb), there was a first positive feedback by other distributions.
About utmp: this will take time. systemd based distributions need to wait for systemd v254, but most big consumers (not writers) of utmp database are working already on replacing utmp with logind. Some for some Linux distributions. No idea what the other distributions will do, there was no reaction, I expect they will use an external libutmpx implementation.

About btmp/lastb: that's only supported by very few tools, which means not reliable, and I haven't found anybody in all discussions who said he is using it/needs it.

[matt335672]

Thanks for taking the time to reply @thkukuk - that's very useful.

[moobyfr]

As author of the wtmp branch, the main problem is only the history. 25 years ago each server program (program managing user connection) had to support itself wtmp/utmp/btmp in its sourcecode. These aren't standard across unix. The usage of pam module has the advantage of providing support for all programs managing users connexions. I'm not even sure if latest version of lightdm/gdm still have direct support for writing wtmp entries
People learned to use whoand last but are not aware of the avaibility of pam_lastlog/pam_lastlog2.

[matt335672]

I think it's pretty straightforward to modify your branch to add the pam_lastlog.so etc calls to the pam modules in the same way you've added pam_loginuid.so. That's lastlog/wtmp done.

There are some changes we need for utmp, notably support for turning it off if it's not required. Let me have a look and see what can be done in that area.

[matt335672]

I've rebased the wtmp branch to devel in my own branch:-

https://github.com/matt335672/xrdp/tree/wtmp

I've also added a few improvements on the end. Notably, you need --enable-utmp on configure to get utmp updating compiled in and working.

It's currently failing testing. The problem is the use of strncpy() which has a gotcha related to the length. I'll fix it tomorrow.

@metalefty, @moobyfr - comments welcome. I'm not going to force-push this to the main wtmp branch unless you're happy with that. Please let me know if you are.

[matt335672]

See PR #2745.