cancel
Showing results for 
Search instead for 
Did you mean: 

Bad Login Information

SOLVED
Go to solution
Marly Koto
Occasional Contributor

Bad Login Information

Hi !
I need some information about bad login.
Is there a command or a file that I can check the bad logins and its respectives ips?
Thanks in advance.
2 REPLIES
Ralf Puchner
Honored Contributor
Solution

Re: Bad Login Information

If you want to log login failures you can use the audit subsystem. audit_setup(8), auditd(8), and sections of the Security manual
explain how to setup and use the audit subsystem.

You can audit login failures specifically, but I recommend using the trusted_event alias. This alias turns on logging of all logins and logouts as well as other system security related events.
Help() { FirstReadManual(urgently); Go_to_it;; }
Blake Roberts
Frequent Advisor

Re: Bad Login Information

If you use the "sysman auditconfig" wizard, I personally use the "profile_audit" and "profile_auth" categories to log both good and bad logings and IPs. Under Advanced Options, you will also want to check "Include failed login usernames if not in password database" and "Audit command name."

I'm assuming you are using one of the 5.1x OS versions. These options are available in 5.1A and 5.1B. It gives about the appropriate amount of messages that I personally like, and it doesn't add too much disk overhead with the audit logs.

--Blake Roberts