From: spaf@cs.purdue.EDU (Gene Spafford)
Newsgroups: comp.security.unix
Subject: Re: Lastlogin?
Date: 8 Aug 1994 19:51:50 -0500
Organization: Purdue University Department of Computer Sciences
Lines: 83

Under most versions of Unix, there is a "lastlog" file that records
the time, and sometimes the terminal, of the last login for each user.
This is then printed as part of the next login as information.  Some
systems also include information on the number of invalid attempts on
the account since the last valid login.

On my systems, the file /usr/include/lastlog.h describes the format of
this file.  Note that I have not seen a "standard" utility that prints
this information out in human readable form -- you have to write your
own!

Well, here is my Perl program to dump the file for SunOS/Solaris
systems (it works on both).  If your lastlog format is different, then
you simply modify this.  You may also need to adjust the path to the
lastlog file.

#!/usr/local/perl/perl
#
#  Gene Spafford  11/93 -- lastlog printer
#   spaf@cs.purdue.edu
#
#  From /usr/include/lastlog.h:
#
# struct lastlog {
#	time_t	ll_time;
#	char	ll_line[8];
#	char	ll_host[16];		/* same as in utmp */
#};

$LOGFILE = "/var/adm/lastlog";

# month names for common usage

@months = ('Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug',
	   'Sep', 'Oct', 'Nov', 'Dec');


setpwent;
($names{$uid} = $name) 
    while (($name, $junk, $uid) = getpwent);
endpwent;

open(LASTL, $LOGFILE) || die "Cannot open $LOGFILE: $!";;

for ($uid = 0; read(LASTL, $record, 28); $uid++) {
    ($time, $line, $host) = unpack('l A8 A16', $record);
    next unless $time;

    ($name = $names{$uid}) || ($name = "($uid)");

    ($sec, $min, $hour, $mday, $mon, $year) = localtime($time);
    $min = "0$min" if $min < 10;
    $hour = "0$hour" if $hour < 10;

    write;
}

format top = 
 User       TTY      Date/Time             (Remote Host)
--------   -----    -------------------    ----------------
.


format =
@<<<<<<<   @<<<<    @>:@>  @<< @>, 19@<    @<<<<<<<<<<<<<<<
$name, $line, $hour, $min, $months[$mon], $mday, $year, $host
.
-- 
Gene Spafford, COAST Project Director
Software Engineering Research Center & Dept. of Computer Sciences
Purdue University, W. Lafayette IN 47907-1398
Internet:  spaf@cs.purdue.edu	phone:  (317) 494-7825