logging login attempts

gzusgeek · 03-18-2008, 03:59 PM

I am trying to find a way to log all login attempts, successful and failed in RHEL5. I've seen the posts about using pam_tally for failed attempts but I can't seem to find anything on how to log successful logins.

Any suggestions?

BrianK · 03-18-2008, 04:29 PM

Quote:

Originally Posted by gzusgeek

I am trying to find a way to log all login attempts, successful and failed in RHEL5. I've seen the posts about using pam_tally for failed attempts but I can't seem to find anything on how to log successful logins.

Any suggestions?

isn't all that already in /var/log/auth.log?

beadyallen · 03-18-2008, 05:29 PM

On my Fedora box I don't have an auth.log(I assume it's the same for RHEL), but all logins (successful or not) get logged in /var/log/secure.

gzusgeek · 03-18-2008, 05:40 PM

Quote:

Originally Posted by beadyallen

On my Fedora box I don't have an auth.log(I assume it's the same for RHEL), but all logins (successful or not) get logged in /var/log/secure.

I knew I had seen it somewhere. The authpriv facility in /etc/syslog.conf. I hope someone comes up with a mod my memory leaks.

Thanks!