display unsuccessful login attempts to user

[SM_3]

How can I display unsuccessful login attempts to a user on 11i?

Thanks.

[RAC_1]

If system is not trusted, then lastb command
If trusted then

getprpw -m ulogint "user_name" would be precise.

[Steve Steel]

Hi


see man lastb

lastb -R|grep username


Steve Steel

[Arunvijai_4]

# lastb will be helpfull in this case.

-Arun

[James R. Ferguson]

Hi:

If '/var/adm/btmp' doesn't exist, create it:

# touch /var/adm/btmp
# chmod 600 /var/adm/btmp

This enable logging of failed logins. You can view this file with 'lastb'. A log of successful logins is similarly enabled if you create 'var/adm/wtmp'. Good logins are viewed with 'last'. See the manpages for 'last' for more information.

A second, useful log to consult is '/var/adm/sulog'. This records both the success and failure of 'su' (switch-user) operations.

Successful transitions are recorded with a "+" notation; unsucessful ones with a "-". For example:

SU 09/19 14:43 - ttyd1p1 mdiag-root
SU 09/19 14:44 + ttyd1p1 mdiag+root

Regards!

...JRF...

[Alessandro Pilati]

Use this command:
lastb -R USERNAME

Where username is the user of which you are checking the failed logins.

Regards,
Alex

[Devender Khatana]

Hi,

lastb is the command with varioud options. It will display the attempts since last reset of /var/adm/btmp file.


HTH,
Devender

[Muthukumar_5]

# lastb -R

hth.

[Nemer_1]

Hi,

use:

/usr/sbin/acct/fwtmp
regards,

[Morcos]

lastb -R | grep your_user. will be helpful in this case.

Ziad

[Raj D.]

Hi SM ,

Simply check it with the lastb command ,
lastb will give all unsuccessful login attempts.

Remember, you need superuser access for lastb.

Else you need to add the read flag for others, for /var/adm/btmp

Cheers,
Raj.

[James R. Ferguson]

Hi (again):

Do *not* give read-permissions to other than root, as the owner of /var/adm/btmp. To do so exposes the possibility that password information might be exposed.

Regards!

...JRF...

[SM_3]

Thanks.

[Bill Hassell]

And to followup on James' recommendation about lastb: The /var/adm/btmp file must be 600 (no read or write access to anyone but root). The lastb command can indeed find a specific user login and you can even limit the list to the last 2 or 5 entries in btmp, BUT login has no way to know when a user is confused and types their login where it says: password? and types the password where it says: login

(of course, sysadmins never have this problem...) This means that by using lastb, a hacker could look for usernames that are unusual, that look like a password. Those strings were typed at the wrong prompt and therefore logged in btmp, reported by lastb. As mentioned, a Trusted system will report both the last successful and unsuccessful login as you first login, but for a 'safe' solution on a non-Trusted system, you have to write a program to get the information from a properly protected btmp file.