Bad Login by root . How to trace?

[Chen Yingjie]

We found our audit report recorded many bad login by "root" in 8 servers.

How to trace these bad login?

I want to know

Who try to login by "root"?
Which terminal(IP) used to login?

Thanks for advise.

[Pete Randall]

Try "lastb root". That will give you bad login information for the root account.


Pete

[Sanjay Kumar Suri]

/var/adm/btmp file has history of unsuccessful logins.

The lastb command is used to display this information.

sks

[Sanjay Kumar Suri]

/var/adm/btmp is owned by and readable only by root and therefore lastb need root to exexcute.

sks

[Chen Yingjie]

Our Audit tool recorded someone try to login. but it has not recorded in the wtmp.

[Sanjay Kumar Suri]

Check /var/adm/wtmp: history of successful logins using last command.

What is bad login by root?

Anyone who has root password is good as long as it is not for bad intentions. Is root passwd not safe?

Is direct root login allowed or one has to do su to access root?

sks

[Muthukumar_5]

Last bad login informations are stored /var/adm/bmtp file. We can collect informations using lastb command.

IF you want to get detailed informations of login failed then use as,

lastb -xR -5

-x extended format
-R hostname / ip-address

-5 count

You can change account of badlogin file to anyother file using lastb -f

terminal of console gives the attempt of login as root

other ttys with users are for their respective logins

[Chen Yingjie]

Our audit tool recorded someone try to use root to login. But, the login was cancelled.

(our audit tool check user login by "root".
once user successfully login by root, it will ask user to type in their ID, if the answer is "N" or non-input, the login in will be cancelled.)

our system allow direct login to root.
and this time no person su to root.

[Muthukumar_5]

You can keep track of user informations and login details on /etc/profile (for normal users) and /.profile for root (super user). You can add script lines there in the profile to accomplish your requirement easily. And what are you asking user to type? ID ??


We can stop users to use su as,

/etc/default/security file,

SU_ROOT_GROUP=groupname which you want to give permission to use su permission

or make a script as,

mv your su to /usr/bin/su1

And make your own script to call su1 after making your script as su.
It has to ask arguments - username and check username is null then ask the user to type user and root can not be used for su

Regards
Muthu

[twang]

HISTFILE=/var/tmp/.history_$LOGNAME
echo "$LOGNAME logon: `finger $LOGNAME |grep from`" >>$HISTFILE

Add the above to /etc/profile, it will record login detail and all commands issued by the login.

[Chen Yingjie]

Thanks for everyone who replyed my question.
We have fixed the problem.

[Chen Yingjie]

the problem is fixed.