Re: bug#64937: "who" reports funny dates

[Paul Eggert]

On 2023-08-06 14:06, Thorsten Kukuk wrote:

> SysV Init is gone and the majority does not miss it, and I don't see a
> reason why "who /var/log/wtmp" needs to stay.

I don't want to get into the middle of another systemd vs init battle. 
But I don't see why this is relevant to that battle. Fedora 38 runs 
systemd, for example, and it still maintains /var/log/wtmp. Likewise for 
Ubuntu 23.04.


> Is there somebody really using btmp? Beside that it is really unreliable
> since nearly no application is writing it, I asked on several mailing
> lists and nobody answered.

Although Ubuntu does not maintain /var/log/btmp, Fedora does. I just 
tested my Fedora 38 workstation, and /var/log/btmp records failed logins 
back when I installed Fedora on it. Attackers on the Internet try to log 
in to this workstation via ssh every few minutes. Logs like btmp could 
be useful for forensics if an attack succeeds.