Audit Failed Login HP-UX

[Leonardo Preciado]

Hi.

I need audit the failed login in HP-UX...some it knows as I can do it.

Thanks.

[A. Clay Stephenson · Accepted solution]

create a file /var/adm/btmp. Man "btmp" for details.

[Patrick Wallek]

Use the 'lastb' command to see failed login attempts. If you add the '-R' switch it will show the IP/hostname from where the login originated.

# lastb

# man lastb
for details

[Jens Keinath]

Hello!
Another option is to enable HP-UX auditing (if the system is trusted) and turn on the login event.
Either use SAM or the following commands:

audsys to turn on the auditing system
audevent to disable/enable events
audisp to convert the auditing file into a readable format

See the related man pages for further details. The commands are pretty good explained.

[Leonardo Preciado]

Hi..thanks..

I type lastb, the following error appears me :/var/adm> lastb
sh: lastb: Execute permission denied.

[Patrick Wallek]

Are you logged in as root? If not, do so.

What are the permissions on /usr/bin/lastb?

[A. Clay Stephenson]

It sounds like you created a file called "/var/adm/lastb". Lastb is an executable normally located in /usr/bin and you do not create it; this file should already exist. The data file that lastb uses is /var/adm/btmp. See if you have this file; if not, create it by "cp /dev/null /var/adm/lastb" and then properly set ownship and permissions. It should be owned by root and and have 600 permissions.