Failed root login

[Nick D'angelo_3]

I would like to configure a script likely, that will email me when someone has
tried to logon as root and failed.

Thanks,

Nickd

[Robert Gamble_3]

I would suggest creating the script to look at /var/adm/sulog checking for
unsuccessful attempts and runs periodically from cron.

Good Luck!

[Jason Luginbuhl_1]

Nick,

Your best bet is probably to use /etc/securetty to restrict root logins to only
the console. There is a man page on securetty if you need more info on that.
Then users who need root access will be forced to su to the root account when
logging in remotely. Each of these su attempts will be monitored and logged.