[Pkg-shadow-devel] Bug#922945: Bug#922945: /var/log/lastlog is a 110 TByte sparse file, seriously affecting backup

[Bálint Réczey]

Control: severity -1 wishlist
Control: tags -1 confirmed upstream

Hi Sam,

Sam Morris <sam at robots.org.uk> ezt írta (időpont: 2021. ápr. 13., K, 19:45):
>
> On Tue, 2021-04-13 at 15:26 +0200, Chris Hofstaedtler wrote:
> > This will then silently hide login failures from userids larger than
> > this ID? Given the original submitter has a user with uid 379400000,
> > why whould this not be logged?
> >
> > If they didn't want those uids to be used, maybe dont assign them?
> >
> > Chris
>
> I think login.defs(5) says it best:
>
> "As higher user IDs are usually tracked by remote user identity and
> authentication services there is no need to create a huge sparse
> lastlog file for them."
>
> The design of the lastlog format means you either have an apparantly
> huge (sparse) file, which causes problems for badly written backup
> software, or you don't record information for users with high UIDs in
> this file at all.
>
> In any case, it looks like OpenSSH has its own code to read/write to
> /var/log/lastlog, rather than using pam_lastlog, so in any case
> changing login.defs wouldn't be sufficient.

Lastlog format is stable for a very long time and I don't think it
would be wise to change it and as Chris pointed out shipping a default
low
LASTLOG_UID_MAX would hide login failures which is also not desired as
a default.

Rsync (3.1.3-8) may be optimized to handle sparse files better, please
open a bug against rsync if you agree:

rbalint at zen:~$ fallocate -l 4000000000 test-sparse-file
rbalint at zen:~$ fallocate -p -l 4000000000 test-sparse-file
rbalint at zen:~$ time rsync -vS test-sparse-file test-sparse-file-copy
test-sparse-file

sent 4,000,976,652 bytes  received 35 bytes  533,463,558.27 bytes/sec
total size is 4,000,000,000  speedup is 1.00

real    0m6.454s
user    0m10.036s
sys    0m1.952s
rbalint at zen:~$ ls -s test-sparse-file*
4 test-sparse-file  0 test-sparse-file-copy
rbalint at zen:~$ ls -lh test-sparse-file*
-rw-rw-r-- 1 rbalint rbalint 3.8G Apr 16 13:27 test-sparse-file
-rw-rw-r-- 1 rbalint rbalint 3.8G Apr 16 13:28 test-sparse-file-copy

Cheers,
Balint