How we can record the login failures?

mahabooba · 02-07-2006, 02:30 AM

Hi every one,
How we can get the information about failure logins in Linux.

Regards,
Mahaboob

reddazz · 02-07-2006, 02:34 AM

Maybe the file /var/log/faillog is what you are looking for.

tizzef · 02-07-2006, 03:39 AM

Hy

You can have a look to the </var/log/secure> on a redhat box.
A helpfull tool is <lastlog> command.

Cheers

mahabooba · 02-08-2006, 02:20 AM

Hi,
I did not get any information in /var/log/faillog .
and I tried in /var/log/secure also.

And also I tried -- lastlog,faillog.But no use.

Please help me in this regard,

Regads,
Shaik

~=gr3p=~ · 02-08-2006, 03:27 AM

on redhat systems:

open the file /etc/pam.d/system-auth and add these entries:

auth required /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root

account required /lib/security/$ISA/pam_tally.so per_user deny=4 no_magic_root reset

save the file then :
# touch /var/log/faillog

now u can monitor failed login attempts and the locked out accounts after the no. of failed attempts has exceeded:

# faillog -u <user name>

mahabooba · 02-08-2006, 03:49 AM

Thanks "~=gr3p=~"

The problem is solved.

Regards,
Shaik

mahabooba · 02-08-2006, 04:06 AM

One more sir,
How can I get the IP-Address of failog.

Regards,
Shaik

~=gr3p=~ · 02-08-2006, 04:59 AM

that depends on what service you are using to let others connect to your linux server remotely like for example ssh etc. the solution i posted above is for local logins.