How can I track failed login attempts? 2

[josel]

Howdy!

I need to track and document failed login attempts.

Where does OS keep this information or what do I need to set to capture said inforamation?

Regards;


Jose Lerebours

KNOWLEDGE: Something you can give away endlessly and gain more of it in the process! - Jose Lerebours

 

[Annihilannic]

The only place I recall seeing anything is in /var/adm/syslog:

[tt]Sep 13 09:12:15 hostname telnetd[15878]: can't find user in protected password database[/tt]

Not very useful! Since the default /etc/syslog.conf puts *everything* in that file I don't think you're likely to find more anywhere else.

If you are using sshd you may have more options, try experimenting with the LogLevel option in sshd_config.

Annihilannic.

 

[PHV]

A starting point:
cd /tcb/files/auth
awk -F: '{for(i=1;i<=NF;++i)if($i~/unsuc/)print substr(FILENAME,3)"\t"$i}' ?/*

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[Annihilannic]

Ah, it's starting to come back to me... userls -x lastUnsuccessfulLoginTime is another way to produce the information PHV mentioned. I wish userls was available on other versions of Unix... you can also list other attributes which may be interesting, for example -x "lastUnsuccessfulLoginTime unsuccessfulLoginAttempts".

Annihilannic.

 

[josel]

PHV,

I tried your script command and it returns something like

abreu u_unsuclog#1125664836

I am guessing that some where in there is the date the login failed. I printed the report via scoadmin/system/
security/reports_manager and the same user shows as failing on 09/02/2005.

Can you help make the relation?

Thanks;


Jose Lerebours


KNOWLEDGE: Something you can give away endlessly and gain more of it in the process! - Jose Lerebours

 

[PHV]

A more elaborated starting point (in ksh):
awk -F: '
{for(i=1;i<=NF;++i)if($i~/unsuclog/)print substr(FILENAME,3),$i}
' ?/* | while read user date
do echo "$user\t$(perl -e 'use POSIX;print ctime($date)')"
done


Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[josel]

Thanks you guys, you both have provided me with good solid
information which I can now use to produce a workable solution.

Regards;


Jose Lerebours

KNOWLEDGE: Something you can give away endlessly and gain more of it in the process! - Jose Lerebours