Log Of Failed Login Attempts?

[Mark Duffy]

Hi all,

This morning a trusted server of mine running 10.20 deactivated an account due to 3 failed login attempts. As a result, scripts running ftp's using the account failed. I don't partuclarly want to increase this users number of retries to more than say 5 (starts to defeat the purpose of the server running in trusted mode). What I do want to know is where a log of failed login attempts is held so I can write a script the will mail a warning to reactivate the account before built in scripts start to fail - obvioulsy making sure these a genuine fails rather than hacks first!!

Does such a log exist?

Cheers,

Mark

[Peter Kloetgen · Accepted solution]

Hi Mark,

login information is stored in utmp and wtmp files in /etc and /var/adm. These files have a non- ASCII structure. Several commands like who and last read their information out of these files. See man utmp and wtmp to get information how to work with these files.

Allways stay on the bright side of life!

Peter

[steven Burgess_2]

Hi

You can also get ftpd to write to the syslog

Check the /etc/inetd.conf file

append -l to ftpd entry to enable logging

You can also increase this by entering -v to debug

Steve

[steven Burgess_2]

Hi

forgot to mention, once you have ammended the file, enter

inetd -c

to get inetd to re-read it's config file

Do not leave -v (verbose logging) enabled as it may increase your syslog.log file depending on how busy the server is

[Mark Duffy]

Thanks guys. I never realised that wtmp could contain bad login info as well as successful. I see that btmp holds bad login info so I'll find a way of manipulating that. I have my ftp set to log so my script could also look at that output as well.

Cheers,

Mark

[Mark Duffy]

An added question to this. In case my script does not run before a 5th failed login attempt, does a trusted system write to a log file once it has deactivated an account which I could let my script examine?

Thanks again,

Mark