topic failed telnet login attempts to syslog in Operating System - HP-UX

failed telnet login attempts to syslog

Janet White — Mon, 28 Nov 2005 17:53:18 GMT

Hi I have trusted systems with auditing turned on, but for SOX they would like failed login attempts written to syslog and forwarded to a centralized logging server running 3rd party software. I have logging set in /etc/inetd.conf (telnetd -l) I see the connections but not failed logins. I come from a secure shell background, but telnet is a must have here right now. How to get failed login attempts written to syslog? Thank you for your time

Re: failed telnet login attempts to syslog

James R. Ferguson — Mon, 28 Nov 2005 18:27:19 GMT

Hi Janet:

Failed logins are logged in '/var/adm/btmp' if the file is present.

If not, 'touch' it to create it. Make sure that the permissions are set *only* to allow root read-access. It is possible that passwords from the failed logins will be exposed in this file.

For more information see the man pages for 'last'. 'lastb' is used to read this binary file as noted therein.

Regards!

...JRF...

Re: failed telnet login attempts to syslog

Pierre Pasturel — Mon, 28 Nov 2005 19:27:04 GMT

Janet -

The HP-UX Host IDS product, available as a free download from software.hp.com, does monitor btmp for 11i (and btmps for 11iv2) for failed login attempts, whether they be for remote (rlogin), telnet, or ssh logins. You simply need to write a trivial script (examples in the Admin Guide) that can be invoked for every failed login attempt and that can then forward the failed login information to your centralized server. The alert will contain the login name that was supplied and the host name and IP address of the host from which the login was initiated.

I have attached a testimonial from one customer who uses our product for SOX compliance.

Let me know if you have any questions regarding HP-UX HIDS, which can do more than just monitor failed logins. The Admin Guide can be found at docs.hp.com.

Pierre

Re: failed telnet login attempts to syslog

Janet White — Mon, 28 Nov 2005 21:18:40 GMT

I like using lastb, but that doesn't get my failed logins to syslog. I will look into the HIDS product. Thank you both.

Re: failed telnet login attempts to syslog

Arunvijai_4 — Mon, 28 Nov 2005 22:44:03 GMT

Just try to restart inetd using # inetd -c or # /sbin/init.d/inetd stop and /sbin/init.d/inetd start. # lastb -R will provide failed login details.

-Arun