Add utmp/wtmp support #2745

matt335672 · 2023-06-30T10:47:35Z

I thought it might be easiest to discuss this now by way of another PR.

For the history, see #38, #890, #1077 and more recently discussion #2744. There are probably others!

The points I took away from the discussion were:-

PAM on at least Linux and FreeBSD is capable of updating wtmp and lastlog, and should be used where possible. This is because these files have a Y2038 problem on glibc systems. See the links in utmp/wtmp/btmp/lastlog #2744 for info on this.
utmp is a harder problem to solve, and in the short term can still be updated with traditional interfaces.
btmp is not used enough to worry about.

I've taken @moobyfr's wtmp branch, rebased it and added a few extra commits. The rebasing was a little challenging as all the code has now moved to sesexec rather than being in sesman. The commits do the following:-

Fix a name collision between the struct exit_status I added to os_calls and the one in (Linux) utmpx.h
Removed wtmp updating code and moved it to the PAM files.
Added --enable-utmp to configure.ac to allow this feature to be used only where required.
Added support for some Linux-specific utmpx fields.
Fixed a testing problem I found with g_strncpy().

On a Ubuntu 22.04 system with this branch, I now have the following when logging on:-

$ who -a | grep testuser
testuser ? xrdp:11      2023-06-30 11:29   ?        137441 (::ffff:<IP4-addr>)
w testuser
 11:30:35 up  1:56,  3 users,  load average: 0.48, 0.35, 0.17
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
testuser xrdp:11  <snipped>        11:29    0.00s  0.00s  0.08s /usr/libexec/gnome-session-binary
$ utmpdump /run/utmp | grep testuser
Utmp dump of /run/utmp
[7] [137441] [:b  ] [testuser] [xrdp:11     ] [<snipped> ] [0.0.0.0        ] [2023-06-30T10:29:28,096368+00:00]
$ who /var/log/wtmp | tail -1
testuser :11          2023-06-30 11:29 (<snipped>)
$ lastlog -u testuser
Username         Port     From             Latest
testuser         :11      <snipped>        Fri Jun 30 11:29:26 +0100 2023

After logging out normally:-

$ who -a | grep testuser
$ w testuser
 11:37:03 up  2:03,  2 users,  load average: 0.08, 0.32, 0.24
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
$ utmpdump /run/utmp | grep testuser
Utmp dump of /run/utmp
$ who -a /var/log/wtmp | tail -2
testuser ? :11          2023-06-30 11:29   ?        137236 (<snipped>)
           :11          2023-06-30 11:34            137236 id=      term=0 exit=0
$ lastlog -u testuser
Username         Port     From             Latest
testuser         :11      <snipped>        Fri Jun 30 11:29:26 +0100 2023

A couple of other points:-

Arch linux doesn't seem to be shipping with either pam_lastlog.so or pam_lastlog2.so at the moment.
Debian/Fedora are still on pam_lastlog.so
OpenSUSE Tumbleweed has moved to pam_lastlog2.so

On another note, I'm going to be unavailable for a lot of July, but I've got a bit of time next Monday to work on this.

moobyfr · 2023-09-20T12:24:29Z

LGTM, thx for getting this back and synced

matt335672 · 2023-09-20T13:42:20Z

I'm waiting on @Nexarian before I merge this - I don't want to disrupt some of the stuff he's looking at.

In the meantime I'll fix the conflicts.

- renamed the two files, including the header was conflicting with official headers - configure look for utmp/utmpx headers, wo we know which struct to use - reworked the usage for linux, works mostly (last still showing 'gone' for loggued users)

like updwtmpx

So /proc/<uid>/loginuid will be filled by the uid of the user. This will fix entries in 'last' with "gone - no logout" instead of 'still logged in'

use g_*

Follow coding standard

AC_GNU_SOURCE is replaced with AC_USE_SYSTEM_EXTENSIONS (available from autoconf 2.6.0)

matt335672 · 2024-02-20T17:39:06Z

A lot of time has passed, so I'm rebasing it. I'll retest soon and hopefully we can get this merged.

Nexarian · 2024-02-20T17:48:15Z

Yeah, at this point I don't think anything I've worked on will affect this in light of the recent merges!

This conflicts with struct exit_status in <utmp.h>

If we're not compiling with USE_UTMP, these defines will not be available

The utmp record is generally looked up by the ut_id field. Setting this field means we can use a blank username and host when the session exits

POSIX.1 doesn't define ut_host in struct utmpx. Also, Linux has support for an exit status value in ut_exit. This commit adds conditional code for both ut_host and ut_exit to maximise portability.

g_strncpy() is the wrong function for copying strings in struct utmp[x] as it always terminates strings. strncpy() itself would be a good choice, but is marked by many compilers as being unsafe to use. str2memcpy() is taken from util-linux, and is exactly right for this application.

matt335672 · 2024-02-21T10:11:36Z

@metalefty - I've retested this and it still works!

Are you happy for me to merge it?

metalefty · 2024-02-21T10:24:43Z

Let me test.

matt335672 · 2024-02-21T12:02:18Z

A couple of testing notes - these will be added to the release notes under the 'packagers and maintainers' section.

Linux

You'll need to compile with --enable-utmp to get utmp support.
wtmp/lastlog support is provided via PAM. I've updated the PAM files in instfiles, so if you're using make install you should be fine. Otherwise you may need to modify /etc/pam.d/xrdp-sesman yourself.

FreeBSD

FreeBSD has its UTX database which replaces all of the above files. It is supported via the FreeBSD pam_lastlog module which I think is called normally anyway. In other words, this should already work on FreeBSD without this PR.

metalefty · 2024-02-21T12:27:53Z

I did a quick test only on Linux. LGTM overall.

BTW, the from entry is not updated after reconnecting another client from a different IP address. Isn't it implemented yet?

[almalinux@a9xrdp ~]$ lastlog -u almalinux
Username         Port     From                                       Latest
almalinux        :10      ::ffff:192.168.96.7                       Wed Feb 21 12:20:08 +0000 2024

metalefty

LGTM, let's merge.

matt335672 · 2024-02-21T14:22:09Z

That's a really good point.

I've had a look at the pam_lastlog source code. The lastlog file is only updated when a session is opened or closed.

The PAM session lifetime is that of the user session - i.e. it starts when the user logs a session in and ends when that session finishes.

For a reconnect we don't start a new session - we only go through the auth and account stages of PAM. So I think this is sort-of expected if we use PAM to implement this functionality.

matt335672 · 2024-02-21T14:29:04Z

I've added your observation to the known issues on the NEWS page. I've also deleted the old wtmp branch from the repo.

matt335672 mentioned this pull request Jul 3, 2023

Wtmp #1077

Closed

matt335672 force-pushed the wtmp branch 3 times, most recently from 62685b8 to 18c7124 Compare September 20, 2023 14:25

matt335672 mentioned this pull request Oct 23, 2023

XRDP not updating lastlog info. #1302

Closed

matt335672 mentioned this pull request Dec 21, 2023

Initial rfx progressive integration #2879

Merged

matt335672 mentioned this pull request Jan 22, 2024

Is there a way to manage xrdp sessions for multiple users? #820

Open

moobyfr and others added 15 commits February 20, 2024 17:37

Initial support for utmp/wtmp on linux

895fe28

remove trailing space

42388ca

sesman: add utmp files to makefile

c103d23

don't forget include utmp.h

3ea3062

os_calls.h needs to be included to use g_snprintf()

56eec32

WIP utmp/wtmp

bacda80

- renamed the two files, including the header was conflicting with official headers - configure look for utmp/utmpx headers, wo we know which struct to use - reworked the usage for linux, works mostly (last still showing 'gone' for loggued users)

Add GNU_SOURCE to configure.ac: it allow usage f more GNU functions,

d3a751c

like updwtmpx

Include sys/time.h to use gettimeofday()

e32671c

cosmetic changes

eaffeaf

Add the loginuid pam module, as we are starting a session.

2af2e03

So /proc/<uid>/loginuid will be filled by the uid of the user. This will fix entries in 'last' with "gone - no logout" instead of 'still logged in'

Add support for FreeBSD

547388d

don't forget a free

58b3989

use g_*

More g_* functions usage

22f17ad

Follow coding standard

Move some definitions, and small fixes

da0f3ce

Remove AC_GNU_SOURCE

49f60fc

AC_GNU_SOURCE is replaced with AC_USE_SYSTEM_EXTENSIONS (available from autoconf 2.6.0)

matt335672 force-pushed the wtmp branch from 18c7124 to 307def2 Compare February 20, 2024 17:37

matt335672 added 3 commits February 21, 2024 09:24

Rename struct exit_status in os_calls

bc9b35c

This conflicts with struct exit_status in <utmp.h>

Remove wtmp updating code

bf53a76

Add --enable-utmp to configure.ac

3b6c9bc

matt335672 added 4 commits February 21, 2024 09:24

Don't use DEAD_PROCESS/USER_PROCESS for add_xtmp_entry

98d6545

If we're not compiling with USE_UTMP, these defines will not be available

Set ut_id field

04c67a5

The utmp record is generally looked up by the ut_id field. Setting this field means we can use a blank username and host when the session exits

Allow some utmpx fields to be optional

b53c683

POSIX.1 doesn't define ut_host in struct utmpx. Also, Linux has support for an exit status value in ut_exit. This commit adds conditional code for both ut_host and ut_exit to maximise portability.

matt335672 force-pushed the wtmp branch from 307def2 to 8cea9b0 Compare February 21, 2024 09:24

metalefty approved these changes Feb 21, 2024

View reviewed changes

matt335672 merged commit b2c0c50 into neutrinolabs:devel Feb 21, 2024
13 checks passed

matt335672 deleted the wtmp branch February 21, 2024 14:28

matt335672 mentioned this pull request Feb 21, 2024

Who is logged in? #870

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add utmp/wtmp support #2745

Add utmp/wtmp support #2745

matt335672 commented Jun 30, 2023

moobyfr commented Sep 20, 2023

matt335672 commented Sep 20, 2023

matt335672 commented Feb 20, 2024

Nexarian commented Feb 20, 2024

matt335672 commented Feb 21, 2024

metalefty commented Feb 21, 2024

matt335672 commented Feb 21, 2024

metalefty commented Feb 21, 2024

metalefty left a comment

matt335672 commented Feb 21, 2024

matt335672 commented Feb 21, 2024

Add utmp/wtmp support #2745

Add utmp/wtmp support #2745

Conversation

matt335672 commented Jun 30, 2023

moobyfr commented Sep 20, 2023

matt335672 commented Sep 20, 2023

matt335672 commented Feb 20, 2024

Nexarian commented Feb 20, 2024

matt335672 commented Feb 21, 2024

metalefty commented Feb 21, 2024

matt335672 commented Feb 21, 2024

Linux

FreeBSD

metalefty commented Feb 21, 2024

metalefty left a comment

Choose a reason for hiding this comment

matt335672 commented Feb 21, 2024

matt335672 commented Feb 21, 2024