LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-12-2010, 06:46 PM   #1
jaypas
LQ Newbie
 
Registered: Jul 2010
Posts: 21

Rep: Reputation: 1
Audit Log - Invalid User


Hello,
I attempted to log on with an invalid username (xxxxx). Access was denied, as I expected.

I then logged on as a user with root privileges. I tried using aureport and ausearch to find the logon attempt by the invalid user, xxxxx. I could not find it.

What are the options for aureport and ausearch that will tell me that an invalid user attempted to log on?

Thanks in advance,
Jaypas
 
Old 08-12-2010, 06:51 PM   #2
Meson
Member
 
Registered: Oct 2007
Distribution: Arch x86_64
Posts: 606

Rep: Reputation: 67
The invalid username might not be logged because people sometimes enter their passwords in the username prompt by accident.
 
Old 08-12-2010, 11:14 PM   #3
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,240

Rep: Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324
Sometimes systems are set to only log invalid attempts if at least n (eg 3) consecutive attempts were made and this value oftens triggers a lockout on the acct also.
Attempts to login as root may be logged separately and always for each attempt.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
RHEL syslog vs audit log idlehands Linux - Security 1 06-24-2010 06:44 PM
audit log rotation jnojr Linux - Security 4 06-02-2009 12:08 PM
auditd audit.log not display date or user mccartjd Linux - Security 10 06-11-2008 09:17 PM
kernel audit - var/log/messages timinator Linux - Security 1 11-13-2007 04:02 PM
Audit Log in AIX? DriveMeCrazy AIX 5 05-16-2004 04:37 PM


All times are GMT -5. The time now is 11:02 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration