topic Re: Failed root login in Operating System - HP-UX

Failed root login

Nick D'angelo_3 — Mon, 07 Feb 2000 05:54:47 GMT

I would like to configure a script likely, that will email me when someone has
tried to logon as root and failed.

Thanks,

Nickd

Re: Failed root login

Robert Gamble_3 — Mon, 07 Feb 2000 07:57:28 GMT

I would suggest creating the script to look at /var/adm/sulog checking for
unsuccessful attempts and runs periodically from cron.

Good Luck!

Re: Failed root login

Jason Luginbuhl_1 — Wed, 09 Feb 2000 06:59:09 GMT

Nick,

Your best bet is probably to use /etc/securetty to restrict root logins to only
the console. There is a man page on securetty if you need more info on that.
Then users who need root access will be forced to su to the root account when
logging in remotely. Each of these su attempts will be monitored and logged.