account lock out and syslog

[Dan Baker_3]

We are moving to locking out user account after 3 consecutive bad login attempts. logging auth.debug shows only the lock-out, not the username being locked out. Where can I get a logged event showing the user name and the fact that it's being locked?

Dan Baker

[Zinky]

If you've a trusted system - the only way that I know that you can do this is to enable auditing.

Or you can try writing a script that periodically scans the passwd db. See the man pages for getprpw command or use "passwd -s".

[Steven E. Protter]

lastb will show the bad login attempts.

passwd -sa will give you a status on the user.

/var/adm/syslog/syslog.log will show this:

Nov 9 14:44:23 su: - ttyp1 turtle
above message repeats two times.

SEP

[Steven E. Protter]

If you convert your system to trusted, the lockout should show up in the audit logs.

Meant for that to be in the original post.

SEP

[Dan Baker_3]

Rather than turn auditing on, we have configured pam and auth to both send debug information to a file, and periodically scan it for the pam "User disabled" message. 5 lines before that, there is a unix_pam_login message that gives the username. If we detect BOTH events 5 lines apart, then we send a syslog event, which is picked up by OpenView. it looks like it will work correctly.

Thanks for the quick response.

Dan Baker