From a393759f9693a08a7fba18d4824b74f2dda1fe3d Mon Sep 17 00:00:00 2001 From: Artem Savkov Date: Tue, 18 Nov 2025 16:26:11 +0100 Subject: [PATCH] Fix ut_type for btmp records According to man utmp ut_type is supposed to be only switched from LOGIN_PROCESS to USER_PROCESS after succesfull authentication and this is how sshd behaved before 671c44078. Fixes: 671c44078 ("use construct_utmp to construct btmp records") Signed-off-by: Artem Savkov --- loginrec.c | 5 ++++- loginrec.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/loginrec.c b/loginrec.c index d57a9d146..7499aa975 100644 --- a/loginrec.c +++ b/loginrec.c @@ -651,6 +651,9 @@ construct_utmp(struct logininfo *li, # ifdef HAVE_TYPE_IN_UTMP /* This is done here to keep utmp constants out of struct logininfo */ switch (li->type) { + case LTYPE_FAILED: + ut->ut_type = LOGIN_PROCESS; + break; case LTYPE_LOGIN: ut->ut_type = USER_PROCESS; break; @@ -1732,7 +1735,7 @@ record_failed_login(struct ssh *ssh, const char *username, const char *hostname, /* Construct a logininfo and turn it into a utmp */ memset(&li, 0, sizeof(li)); - li.type = LTYPE_LOGIN; + li.type = LTYPE_FAILED; li.pid = getpid(); strlcpy(li.line, "ssh:notty", sizeof(li.line)); strlcpy(li.username, username, sizeof(li.username)); diff --git a/loginrec.h b/loginrec.h index 62ddd01d5..42b45f040 100644 --- a/loginrec.h +++ b/loginrec.h @@ -52,6 +52,7 @@ union login_netinfo { */ /* types - different to utmp.h 'type' macros */ /* (though set to the same value as linux, openbsd and others...) */ +#define LTYPE_FAILED 6 #define LTYPE_LOGIN 7 #define LTYPE_LOGOUT 8