login tips — authorized login-session literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may observe login/session state (lab VM / syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any session-affecting write.
3. Record short factual notes; quote short Evidence (user redacted, TTY class, success/fail — never passwords).
4. Optional: last-login DB → lastlog-tips.
5. Optional: failed attempts → lastb-tips.
6. Optional: PAM lockout → faillock-tips.
7. Prefer who / w / last on lab hosts over invasive session capture.
8. Stop at literacy — no attack or unauthorized session-hijack cookbooks.

Allowed framing

• Classroom labs reviewing utmp/wtmp/btmp roles on authorized hosts.
• Binding short factual notes as Evidence (session presence only — no secrets).
• Documenting expected vs observed login messages for authorized inventory notes.
• Comparing login ↔ lastlog / lastb / faillock peer tip pages under one binder.
• Shell/profile (/etc/profile, PAM stacks) literacy when the syllabus authorizes read-only review.

Scope we will not cover

• No crack/pirate/keygen via login.
• No intentional session-hijack PoCs against foreign users.
• No secret-theft or password prompting tricks against hosts you do not own.
• No cookbooks that skip authentication without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host and a disposable lab user.
2. Log in locally (or via authorized console); quote session presence with who / whoami as Evidence.
3. Optional: inspect last-login via lastlog-tips; failed attempts via lastb-tips.
4. Optional: lockout recovery literacy via faillock-tips.
5. Stop at literacy — no attack or unauthorized session cookbooks.

Practical notes for authorized labs

• login itself is often invoked by getty/display managers — binder notes can focus on session artifacts rather than invoking login manually.
• utmp/wtmp/btmp are the usual Evidence surfaces; prefer standard tools (who, last, lastb, lastlog) over raw binary dumps.
• PAM stacks decide much of modern login behavior — quote module names you were shown, never paste secrets from conversation modules.
• Pair with passwd-tips when the syllabus asks about password change at first login.
• Redact remote host fields from last output when notes leave the lab.
• Never install keyloggers or "login wrappers" — even for labs — unless the written syllabus explicitly authorizes a monitored lab account.

FAQ-aligned refusals (quick)

• Foreign session hijacks → refuse.
• Password capture / keylogging → refuse.
• Auth-bypass cookbooks → refuse.

For legal, authorized and educational use only.

FAQ

Sources