topic User Authentication in Operating System - HP-UX

User Authentication

Bharat Katkar — Fri, 30 May 2003 09:03:21 GMT

How can i trace users login attempts and any unauthorised attempts made to access the server. I must be able to monitor IP address with time stamp of the client system who is trying to log in. How do i configure and what is the procedure for the same?

Re: User Authentication

Paula J Frazer-Campbell — Fri, 30 May 2003 09:07:19 GMT

Hi

Last, last -b see man last also check sulog

Paula

Re: User Authentication

Massimo Bianchi — Fri, 30 May 2003 09:10:20 GMT

Hi,
to have full tracing and auditing you must trust your system, but this can have side effects.

If you just want to monitor:

from man 1m login:

/var/adm/btmp History of bad login attempts
/var/adm/wtmp History of logins, logouts, and date changes

you can query this file with the "last" command

Other information can be found in the /var/adm/syslog/syslog.log.

In the end, you can trace remote connetion modifying the /etc/inetd.conf enabling the loggin options for each program.

For the exact option, i suggest a good "man program", i don't know them all.

HTH,
Massimo

Re: User Authentication

Bala_11 — Fri, 30 May 2003 09:28:48 GMT

Hi,

#last -R
#lastb -R

should help you

Re: User Authentication

Rainer von Bongartz — Fri, 30 May 2003 11:16:29 GMT

If you want an off-line trace you can use last/lastb -R.

If you want an on-line trace with active alarms of intrusions you should install IDS/9000 from HP which comes for free from

www.software.hp.com

Regards
Rainer