/var/log/btmp logging ?

[Jarno Huuskonen]

Hi,

Openssh doesn't log failed logins to /var/log/btmp like login does 
(if btmp exists). This is on RH6.2. 

Is there a specific reason for not logging to btmp ? 

I think that logging to btmp would be a 'good thing'(tm). What about
other unices ? Do they have /var/log/btmp or something similar (AIX has
something like that and I think openssh already logs the failed attempts).

AFAIK it wouldn't be too much work to get btmp logging to openssh. Here
are some ideas that came to mind:
- add a failure call to auth1.c and auth2.c (there's already AIX specific
  loginfailed).
- modify loginrec.c so there's a routine to write an entry to btmp
  ( propably just modify wtmp_write_entry so it can take a filename parameter
   and then add write_bad_login-function )

Is somebody interested in this kind of btmp feature ? And any chances
of getting this included in the portable version ?

-Jarno

-- 
Jarno Huuskonen - System Administrator   |  Jarno.Huuskonen at uku.fi
University of Kuopio - Computer Centre   |  Work:   +358 17 162822
PO BOX 1627, 70211 Kuopio, Finland       |  Mobile: +358 40 5388169