topic Re: Invalid Logins in Operating System - HP-UX

Invalid Logins

Eric Coulter_1 — Wed, 28 May 2003 17:50:00 GMT

What is the equivalent of the Solaris loginlog in HP-UX?

Re: Invalid Logins

Pete Randall — Wed, 28 May 2003 17:51:11 GMT

/var/adm/btmp

Pete

Re: Invalid Logins

James R. Ferguson — Wed, 28 May 2003 17:51:21 GMT

Hi eric:

# /var/adm/wtmp

...for good logins

# /var/adm/btmp

...for bad attempts

If the file isn't present, or it is removed, logging never occurs.

Regards!

...JRF...

Re: Invalid Logins

Ken Hubnik_2 — Wed, 28 May 2003 17:52:14 GMT

last and lastb for bad logins.

Re: Invalid Logins

Uday_S_Ankolekar — Wed, 28 May 2003 17:53:05 GMT

/var/adm/wtmp for good and /var/adm/btmp for bad logins.

last command will show individuals last time logins.

-USA..

Re: Invalid Logins

Steven E. Protter — Wed, 28 May 2003 18:33:41 GMT

Attached is a script for monitoring bad logins for hp-ux.

It can be set to disable logins, but I run it on a trusted system and that aspect is handled by the OS now.

This one checks root, but obviously that easy to change.

SEP

Re: Invalid Logins

Yogeeraj_1 — Thu, 29 May 2003 04:15:27 GMT

hi,

If you want to monitor login attempts, below one script we use to monitor root.

===========================================================
#!/bin/ksh

MAILTO=your.name@yourcompany.com

tail -1f /var/adm/syslog/syslog.log | while read line ; do
echo $line | grep -q " - .*root$" && (echo su unsuccessful - `echo $line | cut -d" " -f1,2,3,10` | mailx $MAILTO)
echo $line | grep -q " + .*root$" && (echo su successful - `echo $line | cut -d" " -f1,2,3,10` | mailx $MAILTO)
echo $line | grep -q "login/tcp"

if [ $? -eq 0 ] ; then
echo $line | sed 's/.*inetd.$[0-9][0-9]*$.*/\1/' | read PID
ps -elf | awk '$5 == PID{print $3}' PID=$PID | read USER
echo `echo $line | cut -d" " -f1,2,3` - $USER logged in | mailx $MAILTO
fi
done
===========================================================

hope this helps too!

regards
Yogeeraj