lastb tips — authorized failed-login literacy

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

lastb helps authorized labs sample failed-login literacy on hosts they own. Pair with fail2ban-tips, faillock-tips, journalctl-logs-tips, ausearch-tips, whoami-tips. Prefer lab VMs — never scrape foreign btmp databases without permission.

On this page

Snapshot

FieldValue
Surfacelastb tip checklist
JobAuthorized failed-login literacy
fail2ban peerfail2ban-tips
faillock peerfaillock-tips
journalctl peerjournalctl-logs-tips
ausearch peerausearch-tips

Tip checklist (authorized only)

  1. Confirm you may inspect btmp / lastb Evidence on the host (lab VM / syllabus box you own or were given access to).
  2. Prefer read-only samples — never truncate production btmp without change control and audit notes.
  3. Record short factual notes; quote short Evidence (user, tty/source, timestamp — redact IPs if policy requires).
  4. Optional: ban jails → fail2ban-tips.
  5. Optional: PAM tallies → faillock-tips.
  6. Optional: audit search → ausearch-tips.
  7. Redact usernames, source IPs, and hostnames if policy requires.
  8. Stop at literacy — no exploit / unauthorized login-history cookbooks.

Allowed framing

  • Classroom labs reading failed-login rows on authorized disposable hosts.
  • Binding short factual notes as Evidence.
  • Documenting expected vs observed fail spikes for authorized inventory notes.
  • Comparing lastb ↔ fail2ban / faillock / journalctl peer tip pages under one binder.
  • Using lastb -n to keep excerpts short for binders.

Scope we will not cover

  • No crack/pirate/keygen via lastb.
  • No intentional brute-force / credential-stuffing PoCs against foreign hosts.
  • No credential-theft via login history against hosts you do not own.
  • No bypass cookbooks that wipe btmp to hide unauthorized access.

Beginner path (authorized only)

  1. Obtain one syllabus-approved lab host you control or may inspect.
  2. Run a short read-only lastb -n 20 sample; quote success.
  3. Bind notes as Evidence; redact usernames and source IPs.
  4. Optional: compare with fail2ban-tips / faillock-tips.
  5. Stop at literacy — no attack or unauthorized history-wipe cookbooks.

Practical notes for authorized labs

  • lastb reads /var/log/btmp (permissions usually root-only) — use sudo only when authorized.
  • Limit output with -n / time filters so binders stay short.
  • Pair with journalctl-logs-tips when sshd auth failures also appear in the journal.
  • Failed rows are still PII-adjacent — treat usernames and IPs as redactable.
  • Distinguish syllabus "known bad login" drills from real incident response — label Evidence clearly.
Which to pick
  • Prefer authorized, redacted, read-only Evidence.
  • Use fail2ban / faillock / journalctl peer tip pages when the syllabus asks.
  • No exploit, crack, or unauthorized-access framing.

For legal, authorized and educational use only.

FAQ

What is a "lastb tip" page in BinBench framing?

A checklist for reading authorized failed-login (btmp) Evidence on hosts you own or were given syllabus access to — not a cookbook for scanning foreign login histories.

How does this relate to fail2ban-tips / faillock-tips?

Those pages cover ban jails and PAM faillock tallies. This page zooms on a general lastb tip checklist — it does not overwrite those pages.

Can I run lastb against hosts I do not own?

No. Authorization first. BinBench will not publish unauthorized login-history scraping against foreign hosts.

Does this teach exploit / bypass PoCs via lastb?

No. Mentions of exploit/bypass appear only as refusals. Authorized literacy only — prefer lab VMs and redacted samples.

Does this teach credential theft via lastb?

No. lastb shows failed attempts, not passwords — still redact usernames and source IPs before sharing excerpts.

Sources