topic Re: HOWTO track failed logins in VMS in Operating System - OpenVMS

HOWTO track failed logins in VMS

Steve Longenecker — Sat, 16 Oct 2004 09:51:51 GMT

I need to track failed VMS login attempts for accounts that DO NOT exist on a VMS server. In the UNIX world "lastb" would do the trick, but with VMS I am at a loss. I tried accounting, but all it logs is a LOGFAIL with in the Username column. Any suggestions?

Re: HOWTO track failed logins in VMS

Antoniov. — Sat, 16 Oct 2004 10:11:48 GMT

AFAIK the command is
$ account /since=/type=logfail
example
$ account /since=1-oct-2004/type=logfail

Antonio Vigliotti

Re: HOWTO track failed logins in VMS

Steve Longenecker — Sat, 16 Oct 2004 10:33:11 GMT

Antonio, I already tried "account /since=/type=logfail", but the Username column only lists if the username does not exist in UAF. If the username does exist in UAF, then accounting provides the username for the failed login as expected.

In the UNIX world, "lastb" logs the username for all failed login attempts whether or not the username exists on the server. I need something similar for VMS, but I don't recall ever seeing this functionality.

Re: HOWTO track failed logins in VMS

Bob Blunt — Sat, 16 Oct 2004 10:37:46 GMT

Steve, depending on your VMS version, you should probably check how security auditing is setup on your system. $ SHOW AUDIT will show how it's configured. This will also show the file used for saving those entries. To review them, use $ ANALYZE AUDIT (and qualifiers).

Both commands are documented in $ HELP.

Re: HOWTO track failed logins in VMS

Steve Longenecker — Sat, 16 Oct 2004 10:55:53 GMT

Bob, I tried analyze/audit as well. But all it also logs "" under "Username:", along with "%LOGIN-F-NOSUCHUSER, no such user" under "Status:". I need to know what what Username was used to trigger NOSUCHUSER.

Re: HOWTO track failed logins in VMS

Antoniov. — Sat, 16 Oct 2004 11:17:54 GMT

Steve,
means login failure within wrong user. Analyze/audit can give you more information; for example follow command type login failure of user ANTONIOV:
$ ANALYZE/AUDIT/SINC=1-OCT-2004-
/EVENT=LOGFAIL/SELE=(USER=ANTONIOV)
This work for me :-)

Antonio Vigliotti

Re: HOWTO track failed logins in VMS

Antoniov. — Sat, 16 Oct 2004 11:20:01 GMT

Steve,
I've forgot my previous command have hyphen symbol (-): I use this only for slitting command for two lines; you have not to type it.

Antonio Vigliotti

Re: HOWTO track failed logins in VMS

Antoniov. — Sat, 16 Oct 2004 11:23:44 GMT

Steve,
as Bob posted, you have to enable auditing.
See follow:
$ SHOW AUDIT

System security audits currently enabled for:
[...]
Logfailure: batch,dialup,local,remote,network,subprocess,detached

Antonio Vigliotti

Re: HOWTO track failed logins in VMS

Bob Blunt — Sat, 16 Oct 2004 19:28:53 GMT

In addition, if you have a noisy line or someone started to login (simply pressed a carriage return) and let the attempt timeout, that's all you'll get, "." Depending on the configuration of your security auditing, you'll only get an "attempted" username if something is entered at the prompt.

Usually, getting "" means that a username wasn't entered. Even if you get line noise, you'll have a garbage-looking username in the audit log. Again, depending on how your system is configured and setup, you may get either a terminal port that's consistant or an IP address (depending on configuration, IP stack, VMS version, phase of the moon, your Zodiac sign, etc).

If you can lay hands on VMS' Security-related manuals, they would be your best resource. There's also information that may help on the OpenVMS "Ask the Wizard" pages. I think there are hot links to those on the main OpenVMS pages here...

bob