LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 02-11-2009, 02:15 PM   #1
k1piee
LQ Newbie
 
Registered: Jul 2005
Distribution: Debian squeeze
Posts: 11

Rep: Reputation: 0
Bash script thats checks for faild login attempts.


Hey I need some help with a script that I want to make.
I want it to check in /var/log/auth.log for failed login attempts and print it out like this it the log look like this:

Feb 11 08:06:38 k1piee sshd[19936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns2.desconisp.com user=root
Feb 11 08:06:40 k1piee sshd[19936]: Failed password for root from 202.90.96.60 port 34162 ssh2
Feb 11 08:06:41 k1piee sshd[19938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns2.desconisp.com user=root
Feb 11 08:06:43 k1piee sshd[19938]: Failed password for root from 202.90.96.60 port 34374 ssh2
Feb 11 08:06:45 k1piee sshd[19940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns2.desconisp.com user=root
Feb 11 08:06:47 k1piee sshd[19940]: Failed password for root from 202.90.96.60 port 34551 ssh2
Feb 11 08:06:49 k1piee sshd[19942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns2.desconisp.com user=root
Feb 11 08:06:51 k1piee sshd[19942]: Failed password for root from 202.90.96.60 port 34724 ssh2

Feb 11 08:06:51: Failed login attempt from: 202.90.96.60 with user: root
Feb 11 08:06:51: Failed login attempt from: 202.90.96.60 with user: root
....
....

or something like that. Is there anyone that can help me with that?
It has to be in bash.
 
Old 02-11-2009, 02:39 PM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
You could use the faillog command to list failed logins. The command can also set the number of failed logins when you want the account locked out.
 
Old 02-11-2009, 04:22 PM   #3
k1piee
LQ Newbie
 
Registered: Jul 2005
Distribution: Debian squeeze
Posts: 11

Original Poster
Rep: Reputation: 0
yes I know but I want want a script that list the things that I said, because it for a thing that I am doing
 
Old 02-11-2009, 05:29 PM   #4
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Rocky 9.2
Posts: 18,359

Rep: Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751
Why don't you take a crack at it and show us what you've got if you get stuck?
Try these links:

http://rute.2038bug.com/index.html.gz
http://www.tldp.org/LDP/abs/html/

http://catb.org/~esr/faqs/smart-questions.html
 
Old 02-11-2009, 09:46 PM   #5
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
Look at grep or set to match patterns in the message.

Reading through the messages, are you allowing root logins? It would be better to disallow root logins altogether.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Create a Linix script that prints out all failed login attempts. nick_astn Linux - Newbie 3 08-13-2008 05:56 PM
script to keep 'count' of failed login attempts hattori.hanzo Linux - Newbie 7 04-02-2008 10:23 PM
After login attempts, can a script be run from ssh daemon ? frenchn00b Linux - Software 2 01-02-2008 11:41 PM
bash login script bunnyknight13 Linux - Newbie 4 09-10-2004 08:02 PM
bash login script seanatis Programming 6 09-06-2004 08:00 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 07:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration