How do I trace a failed login

[Christopher Pereira]

I see an :rlogind[20230]: Login failure (exit(28) from login(1))in the syslog....

How do I trace from where this rlogin has originated...

[Sridhar Bhaskarla]

Hi,

Try "lastb -R" command. You should see the failed logins with date stamps and the system from where the connection was attempted. You can compare the time stamps and determine who it might be.

-Sri

[Christopher Pereira]

Hi Sri , Thanks for your quick reply, I was wondering if I could add something in the inetd.conf , that could add some more debug information in the syslog itself.

[Sridhar Bhaskarla · Accepted solution]

Certainly. When invoked with -l option (inetd -l), inetd will log each connection into syslog. However, just to trace rlogin/telnet etc., you don't need inetd running with logging option as you can get that information from 'lastb|last'. If you intend to run inetd with -l, make sure you have enough space in /var/adm/syslog as running it with -l can fill up your /var depending on the type of transactions your system does.

-Sri

[Christopher Pereira]

Excellent!....That is exactly what I was looking for (inetd -l )....Thanks!