Detecting failed logins in Trusted System???

[Kenneth Platz]

Hey everyone,

I've been levied by our in-house security team to write a script that will email our systems admins whenever someone attempts to login as root and fails.

For users attempting to login through "su" and "ssh", this is pretty straightforward, as these are logged in the sulog and syslog.log, respectively. However, the logins through "telnet" (yes, we haven't been allowed to turn that off yet, go figure), for some reason do NOT log in syslog, at least not for Trusted Systems.

My requirement is that I need to detect when someone generates enough failed logins (5) to kick them out of the login program. Can someone please point me in the right direction on this?

Thanks in advance!

[Arunvijai_4 · Accepted solution]

Hi kenneth,

You can take a look at this page : http://docs.hp.com/en/B2355-90121/ch02s05.html

-Arun

[Steven E. Protter]

Shalom,

lastb

The command reads the binary file /var/adm/btmp and will provide the information.

You will probably want to select by date so you don't get the same complete report every day.

SEP

[Mel Burslan]

Ken,

Is your inetd daemon running with the logging enabled ?

[Kenneth Platz]

Arun,

That's *exactly* the information I was looking for. I should be able to stick the audisp into my script to grab what I need.

Thanks a bunch!