Need to know authentication failure attempts and forward them to another machine FC11

Raheel Hassan · 11-11-2009, 08:39 AM

Hello,

I need to know where i can see(which is the file) all the login failures in my fedora core 11. Secondly i need to forward those logs to another Linux machine. What changes i need to do in which file.

Regards,
RAHEEL.

TB0ne · 11-11-2009, 08:57 AM

Quote:

Originally Posted by Raheel Hassan

Hello,

I need to know where i can see(which is the file) all the login failures in my fedora core 11. Secondly i need to forward those logs to another Linux machine. What changes i need to do in which file.

Regards,
RAHEEL.

They're probably in /var/log/messages. If not, reference any one of the many syslog configuration guides for Linux, to make sure the messages are going to that file. You can also configure syslog to write those messages to whatever file you want, too.

After that, just mirror your syslogs to another server, by putting the correct option in the syslog configuration file, usually something like

Code:

*.auth   <remote server ip address>

chrism01 · 11-11-2009, 07:46 PM

lastb shows a list of bad login attempts http://linux.die.net/man/1/lastb

Raheel Hassan · 11-12-2009, 04:04 AM

Well i checked by adding,
*.auth <remote server ip address>
but it did not work then i tried
*.* @<remote server ip address>
which worked. I have seen the messages using tcpdump -i eth0 that are going towards the syslog server where i have to store them, but the problem is that they are not present at the server the ip of my server is 192.168.0.3 and my IP is 192.168.0.4.

For the lastb i checked it trying openeing (/var/log/wtmp
/var/log/btmp) these file but it says that they are binary files.

Regards,

abefroman · 11-12-2009, 04:56 AM

Quote:

Originally Posted by Raheel Hassan

Well i checked by adding,
*.auth <remote server ip address>
but it did not work then i tried
*.* @<remote server ip address>
which worked. I have seen the messages using tcpdump -i eth0 that are going towards the syslog server where i have to store them, but the problem is that they are not present at the server the ip of my server is 192.168.0.3 and my IP is 192.168.0.4.

For the lastb i checked it trying openeing (/var/log/wtmp
/var/log/btmp) these file but it says that they are binary files.

Regards,

You have to use last to view wtmp and btmp:

Code:

last /var/log/wtmp

So you can make a shell script"

Code:

#!/bin/bash
last /var/log/wtmp >>/var/log/wtmp.txt
rsync /var/log/wtmp newip:/var/log/

If your just looking for failed logins, those would probably be in /var/log/messages and /var/log/secure

You can log remotely, and securely with rsyslogd, which should already be on your FC11. syslog does not send the logs encrypted by default.

TB0ne · 11-12-2009, 07:51 AM

Quote:

Originally Posted by Raheel Hassan

Well i checked by adding,
*.auth <remote server ip address>
but it did not work then i tried
*.* @<remote server ip address>
which worked. I have seen the messages using tcpdump -i eth0 that are going towards the syslog server where i have to store them, but the problem is that they are not present at the server the ip of my server is 192.168.0.3 and my IP is 192.168.0.4.

For the lastb i checked it trying openeing (/var/log/wtmp
/var/log/btmp) these file but it says that they are binary files.

Regards,

Right, and they won't be until you configure syslog on your remote server, to ACCEPT the incoming messages, and log them.

Again, read the documentation on syslog/syslog-ng, which has complete descriptions on how to set up everything you're trying to do.

chrism01 · 11-12-2009, 07:09 PM

Typically, on the target/remote server, edit /etc/sysconfig/syslog, adding '-r' to SYSLOGD_OPTIONS.

On the src/local system

*.auth @192.168.1.1 (ie remote server ip)