> sshd [which Collin installed recently] somehow fiddles with wtmp and
> utmp and makes them look wierd and useless.
Glad you found it. Tell me... Did you download an sshd binary, or did you
compile it on your own machine? I've read that different libraries use
different formats for the utmp/wtmp data. If you didn't compile sshd
yourself, it might have been compiled against libraries that write
utmp/wtmp data using a different "struct utmp" (or whatever) than your
system utilities, like who and last, expect. (If you *did* compile it
yourself, then I'm still at a loss to explain the problem...)
See the Usenet article
http://www.dejanews.com/getdoc.xp?AN=406442537
as a reference if you're interested. (That *should* be a permanent-style
Dejanews URL.)
Editorializing a bit, since it's late and I'm down in Florida without much
else to do, this is (in my opinion) one of the things about Linux's
freedom that makes it both challenging and interesting. Anyone can worry
about different versions of system utilities like "who" (and recompile
them as a routine matter of maintenance -- like the people in the Usenet
thread I mentioned), but it seems to happen more frequently on Linux than,
say, HP-UX -- much less Windows NT!
Or maybe that's wrong, but as I said, it's late, and it seemed like an
interesting idea to try... Have a Happy New Year, everyone!
Shawn