utmpdump tips — authorized utmp/wtmp literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may read utmp/wtmp/btmp on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write-back (utmpdump -r) — never poke production login databases without change control.
3. Record short factual notes; quote short Evidence (record type, tty — never full PII session dumps).
4. Optional: who peer → who-tips.
5. Optional: bad-login peer → lastb-tips.
6. Prefer disposable lab VMs for utmpdump drills; quote record-type labels afterward as Evidence.
7. Prefer read-only dumps for most Evidence binders unless the syllabus asks for a write-back drill.
8. Stop at literacy — no attack or unauthorized login-forge cookbooks.

Allowed framing

• Classroom labs reviewing utmpdump /var/run/utmp (or syllabus path) on authorized disposable hosts.
• Binding short factual notes as Evidence (type/tty — no PII dumps).
• Documenting expected vs observed login-record shapes for authorized inventory notes.
• Comparing utmpdump ↔ who / w / lastb peer tip pages under one binder.
• Testing -r write-back only when the syllabus authorizes that drill on lab files.

Scope we will not cover

• No crack/pirate/keygen via utmpdump.
• No intentional unauthorized utmp forgeries against foreign hosts.
• No secret-theft or PII harvesting via session dumps on hosts you do not own.
• No cookbooks that clear wtmp/btmp to hide unauthorized access.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with readable utmp/wtmp.
2. Prefer a copy of lab utmp before any write-back drill.
3. With authorization, run utmpdump on the syllabus-approved path; quote non-secret type/tty labels as Evidence.
4. Optional: who peer with who-tips; lastb peer with lastb-tips.
5. Stop at literacy — no attack or unauthorized forge cookbooks.

Practical notes for authorized labs

• utmpdump text-ifies binary utmp records — keep Evidence labels distinct from who-tips human summaries.
• Session records may embed usernames/hosts — redact PII before notes leave the lab.
• Pair with w-tips / login-tips when those tools are the friendlier front-ends for related Evidence.
• Prefer documenting type/tty labels the syllabus authorized without dumping full remote-host lists.
• Never commit utmp dumps with PII to git — even for labs.
• Label lab-only utmp drills clearly so they are not mistaken for production forensics claims.

FAQ-aligned refusals (quick)

• Foreign-host utmp dump / forge → refuse.
• Unauthorized wtmp-clear / cover-tracks cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources