🚀 go-pugleaf

In article <1992Aug27.200330.24859@news.duc.auburn.edu> hendefd@woof.duc.auburn.edu writes:
>What is a .hushlogin file and why does my system have an empty 
>one in /usr/spool/uucppublic?

From Sun login(1)

     When successful, login updates accounting files, prints disk
     usage  and  limits (by running quota(1),) prints the message
     of the day, informs you of the existence of  any  mail,  and
     displays  the  time  you last logged in.  None of these mes-
     sages is printed if there is a .hushlogin file in your  home
     directory.   This  is  mostly  used  to make life easier for
     nonhuman users, such as uucp(1C).

The crackers may have used this file to store data, stolen passwords,
etc.

Since the contents of .hushlogin (so far as I know) are ignored, this
is a fairly good place to hide something.

Adam



Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.      

hendefd@woof.duc.auburn.edu (Frank Henderson) writes:

>I checked the FAQ and searched all available posts and RT_M, but
>I can't find any info on hushlogin as mentioned in CERT-92:14 -->

>       2. If the check from (A.1) indicates that your binaries have been
>	   modified, check for the presence of a password
>	   log file.  Since the name of the logfile is often changed,
>	   the name of the file should be obtained using the
>	   "strings(1)" command on the Trojan login, uucpd, or telnet
>	   binary.  Examples of filenames used on other systems are:

>                               "/usr/spool/. " (dot space)
>                               "/var/spool/secretmail/.l"
>                               "/var/spool/secretmail/.log"
>                               "/var/spool/secretmail/.tty"
>                               "/var/spool/secretmail/.lock"
>                               "/usr/tmp/.log"
>                               "/usr/spool/uucp/.sys"
>                               "/usr/spool/uucppublic/.hushlogin"

>What is a .hushlogin file and why does my system have an empty 
>one in /usr/spool/uucppublic?

A .hushlogin prevents startup messages (like /etc/motd and
``You have mail''). .hushlogin is also recommended for
non human users, as the contents of /etc/motd can confuse
e.g., uucico. That is precisly the reason (I think) that
Sun ships an empty .hushlogin file in /usr/spool/uucppublic.

If things are normal, /usr/spool/uucppublic/.hushlogin has the same
last modified date as the bulk of the OS files.

Casper
-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl

hendefd@woof.duc.auburn.edu (Frank Henderson) writes:


>What is a .hushlogin file and why does my system have an empty 
>one in /usr/spool/uucppublic?

'man login' gives the answer: When .hushlogin exists in the
home-directory of a user, login will not print out the 
message of the day, whether new mail arrived and the time
of the last login. This is mostly used to make life easier for
nonhuman users, such as uucp.


Hadmut

In article <1992Aug27.214859.8408@das.harvard.edu>, adam@calliope.uucp (Adam Shostack) writes:
|> In article <1992Aug27.200330.24859@news.duc.auburn.edu> hendefd@woof.duc.auburn.edu writes:
|> >What is a .hushlogin file and why does my system have an empty 
|> >one in /usr/spool/uucppublic?
|> 

Here's an interesting little hack that one of our consultants here at UF came up with.  This is nice for those of us that have to use public workstations, and have to log on and off a lot, or for windowing environments.

# Show motd only if it has changed
cmp -s ~/.hushlogin /etc/motd
if ($status != 0) then
  tee ~/.hushlogin < /etc/motd | more
endif

Steve

-- 
"There are worlds out there where the sky is burning.  The sea's asleep, and
the rivers dream.  People made of smoke and cities made of sound.  Somewhere
there's danger.  Somewhere there's injustice.  Somewhere else the tea's getting 
cold. 	Come on Ace, we've got work to do." -Dr Who, spp@reef.cis.ufl.edu

In article <36961@uflorida.cis.ufl.edu> spp@crane.cis.ufl.edu (Stephen Potter) writes:
>Here's an interesting little hack that one of our consultants here at UF came
>up with.  This is nice for those of us that have to use public workstations,
>and have to log on and off a lot, or for windowing environments.
>
># Show motd only if it has changed
>cmp -s ~/.hushlogin /etc/motd
>if ($status != 0) then
>  tee ~/.hushlogin < /etc/motd | more
>endif

Which could also be somewhat streamlined into:

find /etc/motd -newer ~/.hushlogin -exec cat {} \; -a -exec touch ~/.hushlogin \;

(note the trailing semi is really on the same line, and is required for
proper command termination)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Tim Gurbick a.k.a. teg@peabody.iusb.indiana.edu Dept of Math & CS: 237-GEEK
 Help: 911  d.b.a. teg@natasha.iusb.indiana.edu  `whois \!TEG12` Traci:0x45
#include <fnord.h> tgurbick@indiana.edu Chi mi frena in tal momento? emacs!
Me: International Unix Standards Bored, educational division: (219)237-IHEX
address: CS Dept IUSB POB 7111 1700 Mishawaka Avenue, South Bend, IN  46634
"Work FOR?  I don't work FOR anybody...  I'm just having fun." - The Doctor