86

My /var/log/btmp file is 1.3 GB in size. I've read that the file is "Used to store information about failed login".

What does this mean for my server? And can I delete this file?

  • 1
    1.3GB? Mine was 14GB... haha – slehmann36 Feb 14 '19 at 15:55
103

This means people are trying to brute-force your passwords (common on any public-facing server).

It shouldn't cause any harm to clear out this file.

One way to reduce this is to change the port for SSH from 22 to something arbitrary. For some additional security, DenyHosts can block login attempts after a certain number of failures. I'd highly recommend installing and configuring it.

| improve this answer | |
25

fail2ban can also be a great help for machines that must keep internet facing, port 22 SSH. It can be configured to use hosts.allow or iptables with flexible thresholds.

| improve this answer | |
  • I'm using that, but it doesn't prevent btmp from filling up so this isn't a completely helpful answer by itself. I would like to know if there's a way to make these logs rotate or be limited in size, which I'm trying to look up. – leetNightshade Jun 7 '18 at 22:02
  • I find that fail2ban helps to reduce the volume somewhat. I have mine set to 3 attempts, ban for 2 hours. Each IP, once banned, cannot contribute to btmp for that period. That said, fail2ban will be inoperative once you run out of disk space. – Akom 2 days ago
12

You could also examine the file with the lastb command and determine the IP number and maybe block the IP number or network from further accessing your machine. This will also provide information as to the account being hacked. Most likely it will be root but you never know

| improve this answer | |
  • 1
    lastb -a | more is a good way to get the full remote host info, and get a sense for what is going on. – nealmcb Jan 29 '17 at 15:27
6

What I do, although I script it, is use the command like so:

lastb -a | awk '{print $10}' | grep -v ^192 | sort | uniq | sed '/^$/d'

**the "^192" is my local network first octet (non-routable) I automate this (also scripted) like so:

for i in `lastb -a | awk '{print $10}' | grep -v ^192 | sort | uniq | sed '/^$/d'`; do iptables -A INPUT -s $i -j DROP ; done
iptables-save

Or

for i in `lastb -a | awk '{print $10}' | grep -v ^192 | sort | uniq | sed '/^$/d'`
do
iptables -A INPUT -s $i -j DROP
done
iptables-save

Just different look for visibility... This works well for me

As for the size of the /var/log/btmp file you need to enable logrotate for that- look at you logrotate conf file for a similar file being rotated for how to do that- usually in /etc/logrotate.d/ - look at the syslog or yum for the format, and man logrotate will show you all the options. C4

| improve this answer | |
4
echo ‘’ > /var/log/btmp

That will regain the space. Leave for a little to populate a bit then implement iptables, change ssh port or install and configure fail2ban

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.