topic Login failure report in Operating System - HP-UX

Login failure report

PM Srividhya — Thu, 15 Feb 2007 02:55:12 GMT

Hi,

I want to generate a login failure report on HP-UX for a given month.

Could any one help me how to do it?

Thanks,
Vidhya

Re: Login failure report

Ivan Krastev — Thu, 15 Feb 2007 03:24:40 GMT

Use lastb command - http://docs.hp.com/en/B2355-90128/last.1.html

regards,
ivan

Re: Login failure report

Peter Godron — Thu, 15 Feb 2007 04:15:59 GMT

Hi Vidhya,
as the previous post only helped with part of the answer, can you please explain in more details what you want as a report ?

Re: Login failure report

PM Srividhya — Thu, 15 Feb 2007 04:52:54 GMT

Hi Ivan,

Thanks for the information.

But `lastb` could be run only by superuser.

I want to generate a report which should give me the list of login failures for a month and this will be part of a menu run by an operator!

Thanks,
Vidhya

Re: Login failure report

Sunny Jaisinghani — Thu, 15 Feb 2007 09:07:10 GMT

hi

try using this command in a script.

strings /etc/btmp

sunny

Re: Login failure report

James R. Ferguson — Thu, 15 Feb 2007 09:15:33 GMT

Hi:

> But `lastb` could be run only by superuser.

The is very good reason for this!

Unsuccessful login attempts are tracked in the '/var/adm/btmp' file. The file should NOT be readable by any user other than root. This is because *anything* keyed by the user is recorded. It is possible that password information could be seen in the file.

Regards!

...JRF...

Re: Login failure report

OldSchool — Thu, 15 Feb 2007 09:30:25 GMT

"But `lastb` could be run only by superuser.

I want to generate a report which should give me the list of login failures for a month and this will be part of a menu run by an operator! "

ok, then either suid /usr/bin/lastb so that it runs as root, or install and configure "sudo"

I recommend the latter.

Re: Login failure report

James George_1 — Thu, 15 Feb 2007 09:57:11 GMT

Hi

Here is the script that I use to get this info . This will mail me a monthly report of all the failed login informations.

Rgds / james

Re: Login failure report

Bill Hassell — Thu, 15 Feb 2007 16:20:34 GMT

To expand even more on this report: it should never be run by an operator and more important, it should never be published!!!! And /var/adm/btmp MUST NEVER be readable by anyone except root. The reason is that many users will mistakenly type their password when the prompt says "Please login" and now a password is visible in the btmp file.

So don't even bother with sudo or su or any other method to be able to run lastb or read btmp. The lastb command should only be used in looking for hackers -- and that requires somone who is trained in computer security.