bad login capture and SU question.

[brian_31]

Team:

We are developing a script for bad logins. we scan thru the btmp and disable the id after 5 unsuccessful logins. The question is
1. how do we handle the root account (they normally login as user and su to root)
so..is su captured in btmp?

Thanks

Brian.

[Robert-Jan Goossens]

Brain,

How about converting your system to a trusted system ?

Robert-Jan.

[Pete Randall]

Brian,

You need to look at /var/adm/sulog. Good su attempts are logged with a plus sign (+), bad with a minus sign (-).


Pete

[Mark Grant]

I am not sure if they are recorded to /etc/btmp but they are recorded in the syslog.log

[Brian Bergstrand]

As Robert said, convert to a trusted system. You can set a global policy of 5 bad login attempts and then set a specific policy for root if you want less or more attempts. All from within sam.

Don't reinvent the wheel, let the system handle this for you. The only reason not to go trusted would be if you were using NIS.

I think Robert deserved more than one point for the suggestion. It's the right way to go.

HTH.