Bug 831888

Summary:	virt-manger does not update wtmp information
Product:	Red Hat Enterprise Linux 7	Reporter:	Rob Lowe <rlowe>
Component:	virt-manager	Assignee:	virt-mgr-maint
Status:	CLOSED WONTFIX	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	acathrow, berrange, crobinso, cwei, dallan, hyao, lcui, mjenner, mkletzan, mzhan, tzheng
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-02-02 18:01:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rob Lowe 2012-06-14 02:32:27 UTC

Description of problem:

This is probably more of a feature request...

virt-manger does not update /var/log/wtmp information. It would be useful to have this information when auditing authentications. I understand that there is information logged to /var/log/secure (LOG_AUTHPRIV), but these may be rotated and removed (a month, by default), while wtmp is often retained for much longer.


Steps to Reproduce:
1. Connect to virt-manager instance and disconnect soon after.
2. Wait 5 minutes (to ensure there is a decernable difference in the time between connections) and then login via SSH.
3. Run the last(1) command.
  
Actual results: Only the SSH connection will be visable in the last command output.


Expected results: Both the SSH and the virt-manager connection would be visible in the last command.

Comment 4 Martin Kletzander 2013-04-11 13:56:14 UTC

Can you describe more closely what connection to virt-manager instance are you referring to?  Are you using virt-manager to connect to remote libvirtd instance using ssh?

Comment 5 Rob Lowe 2013-04-15 01:48:44 UTC

(In reply to comment #4)

> Are you using virt-manager to connect to remote libvirtd
> instance using ssh?

Yes, that is correct.

Comment 6 hyao@redhat.com 2013-06-19 08:58:44 UTC

I've reproduce the bug on both rhel6.4 and rhel7:
rhel6.4:
libvirt-0.10.2-18.el6_4.5.x86_64
selinux-policy-targeted-3.7.19-195.el6.noarch
virt-manager-0.9.0-18.el6.x86_64

rhel7:
libvirt-1.0.6-1.el7.x86_64
virt-manager-0.10.0-0.5.gitde1695b2.el7.noarch

Comment 8 Cole Robinson 2013-07-16 14:14:21 UTC

This is a general ssh 'problem', nothing specific to virt-manager or libvirt. We run 'ssh [cmd]' and a google search shows this doesn't update wtmp information. Specifying ssh -t will probably make this work, but historically we try not to mess with our ssh cli generation since it is fragile and hard to make it work across multiple distros.

As you mention, this information is already recorded in /var/log/secure. If it's rotated too fast I'm sure that can be adjusted somewhere.

If we are going to 'fix' this, we need another bug report to track libvirt ssh usage as well. However my recommendation is CLOSED->WONTFIX.

Comment 9 Cole Robinson 2014-02-02 18:01:40 UTC

Closing as WONTFIX like I originally suggested.