failed telnet login attempts to syslog

[Janet White]

Hi I have trusted systems with auditing turned on, but for SOX they would like failed login attempts written to syslog and forwarded to a centralized logging server running 3rd party software. I have logging set in /etc/inetd.conf (telnetd -l) I see the connections but not failed logins. I come from a secure shell background, but telnet is a must have here right now. How to get failed login attempts written to syslog? Thank you for your time

[James R. Ferguson]

Hi Janet:

Failed logins are logged in '/var/adm/btmp' if the file is present.

If not, 'touch' it to create it. Make sure that the permissions are set *only* to allow root read-access. It is possible that passwords from the failed logins will be exposed in this file.

For more information see the man pages for 'last'. 'lastb' is used to read this binary file as noted therein.

Regards!

...JRF...

[Pierre Pasturel · Accepted solution]

Janet -

The HP-UX Host IDS product, available as a free download from software.hp.com, does monitor btmp for 11i (and btmps for 11iv2) for failed login attempts, whether they be for remote (rlogin), telnet, or ssh logins. You simply need to write a trivial script (examples in the Admin Guide) that can be invoked for every failed login attempt and that can then forward the failed login information to your centralized server. The alert will contain the login name that was supplied and the host name and IP address of the host from which the login was initiated.

I have attached a testimonial from one customer who uses our product for SOX compliance.

Let me know if you have any questions regarding HP-UX HIDS, which can do more than just monitor failed logins. The Admin Guide can be found at docs.hp.com.

Pierre

[Janet White]

I like using lastb, but that doesn't get my failed logins to syslog. I will look into the HIDS product. Thank you both.

[Arunvijai_4]

Just try to restart inetd using # inetd -c or # /sbin/init.d/inetd stop and /sbin/init.d/inetd start. # lastb -R will provide failed login details.

-Arun