utmp, wtmp and btmp

The three binary login databases. Current sessions, the historical record, and the failed attempts, in three files that are trivially editable by anyone with root.

linux · Authentication · T1078T1070

where it lives

/var/run/utmp

Most distributions

Who is logged in right now. Rewritten constantly.

/var/log/wtmp

Most distributions

The historical record, read with last.

/var/log/btmp

Most distributions

Failed attempts, read with lastb. Root only.

what it proves

  • Session start and end, the account, the terminal, and the remote host where applicable
  • Failed authentication attempts in btmp, which is where a brute force is visible as a shape
  • Boot times, which anchor everything else on the timeline

what it does not prove

  • Anything that did not create a session. An SSH command executed without a login shell may leave nothing here
  • Integrity. These are fixed-size binary records that can be edited in place, and tooling to do it is widely available
  • The real source address behind a jump host or a NAT boundary

parsing it

  • last
  • lastb
  • utmpdump
  • python-utmp

tampering and anti-forensics

Editing these is a well-established and easy step. utmpdump round-trips the format to text and back, so a selective removal leaves a structurally valid file. Corroborate against auth logs and the journal rather than trusting them alone.

how long it survives

wtmp rotates on the distribution schedule, commonly monthly.

where this comes from

read next

linux auth logs · auditd

Verify against the host in front of you before this reaches a report. Paths and behaviour move between Windows builds, and a documented default is not necessarily the setting on that machine. Corrections are published.

utmp, wtmp and btmp, artifact reference · Security Artifacts