Failed login log locations?

[Craig A. Sharp]

Where does HPUX 11.0 keep logs of failed login attempts. I have nothing going to the syslog. I see all logins in btmp.

Also does anyone have a script to page the admin when there is a failed login attempt.

Thanks,

Craig Sharp
Roush Industries

[Rob Smith · Accepted solution]

Hi, the command lastb, if you use the -R switch it will tell you where the attempt is coming from, will give you a list of bad logins. Bad login attempts are logged in /var/adm/btmp. Make sure that file is readable only by root because sometimes it contains passwords. Hope this helps.

Rob

lastb -R | head <=== For the last 10 bad attempts.

lastb -R root <=== To see all bad attempts as root.

[Craig A. Sharp]

Excellent answer, thank you. That was what I needed. Now I need to find a way to be notified of a failed login attempt.

Craig