LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   Failed logins are logged to syslog with the login id set to UNKNOWN or UNSET (http://www.linuxquestions.org/questions/linux-security-4/failed-logins-are-logged-to-syslog-with-the-login-id-set-to-unknown-or-unset-885639/)

ssnodgra 06-10-2011 02:53 PM

Failed logins are logged to syslog with the login id set to UNKNOWN or UNSET
 
Failed login attempts are logged to syslog with the user id or login id set to UNKNOWN_USER or UNSET.

Anybody know if this is configurable. I would rather it just pass the actual id that the user used. Doesn't matter if it exist or not, just want to know if someone is guessing at user names and what those user names are.


Thanks in advance

Noway2 06-12-2011 07:34 AM

Quote:

Failed login attempts are logged to syslog with the user id or login id set to UNKNOWN_USER or UNSET.
Are these perchance failed SSH login attempts? It is quite possible that you are seeing script activity and it dropped before identifying with a user name.


All times are GMT -5. The time now is 09:54 PM.