Bad Login Information

[Marly Koto]

Hi !
I need some information about bad login.
Is there a command or a file that I can check the bad logins and its respectives ips?
Thanks in advance.

[Ralf Puchner · Accepted solution]

If you want to log login failures you can use the audit subsystem. audit_setup(8), auditd(8), and sections of the Security manual
explain how to setup and use the audit subsystem.

You can audit login failures specifically, but I recommend using the trusted_event alias. This alias turns on logging of all logins and logouts as well as other system security related events.

[Blake Roberts]

If you use the "sysman auditconfig" wizard, I personally use the "profile_audit" and "profile_auth" categories to log both good and bad logings and IPs. Under Advanced Options, you will also want to check "Include failed login usernames if not in password database" and "Audit command name."

I'm assuming you are using one of the 5.1x OS versions. These options are available in 5.1A and 5.1B. It gives about the appropriate amount of messages that I personally like, and it doesn't add too much disk overhead with the audit logs.

--Blake Roberts