Bad login attempts

[susee_sundar]

Hi

Where i will find the unsuccesful login attempts in hp unix

[Torsten.]

# lastb

do a man for "last" or "lastb" for more information.

[rariasn]

Hi susee

Man last # lastb

rgs,

ran

[Arunvijai_4]

# lastb -R

-Arun

[rariasn]

Hi susee

Man last and lastb

rgs,

ran

[Enrico P. · Accepted solution]

Hi,

/var/adm/btmp

File utmp contains a record of all users logged onto the system. File
btmp contains bad login entries for each invalid logon attempt. File
wtmp contains a record of all logins and logouts.

from man wtmp

This file are used by last, who, write, and login comand.

Enrico

[Steven E. Protter]

Shalom,

Its very important from the security standpoint to make sure /var/adm/btmp and /var/adm/wtmp exist on the system.

You can use these files and the lastb last command to run audit reports and spot problem users. With the -R or -r parameter lastb provides the login ip address.

SEP

[Delrish]

last and lastb indicate last logins of users and ttys. Al so it shows you all the login attempts. As I know you cannot get the unsuccessful logings with these commands.

[rariasn]

Hi,


The lastb command searches backwards through the database file
/var/adm/btmp to display bad login information. Access to
/var/adm/btmp should be restricted to users with appropriate
privileges (owned by and readable only by root) because it may contain
password information.

rgs,
ran

[susee_sundar]

/var/adm/btmp file contains the information of
bad login attempts

THANKS to ALL

[inventsekar_1]

all answered ur question.

little more info:

/var/adm/sulog
/var/adm/shutdownlog
------------------
/var/adm/wtmp -successful logins
/var/adm/btmp -bad logins
/etc/utmp -info for "who" and "write"
use "strings" command to view these file.