how to write a script for find out unauthorized access users

[Khairul_1]

Hi,
We have rx5670 HP-UX 11i v2 11.23 running cluster system. We want to monitor unauthorized access on the production system.

Could any one help us to write a script to find the unauthorized access user information and send another file location?


Thanks
Khairul

[OFC_EDM]

Look at your syslog. When a user makes to many unsuccessful attemps to login an entry is made in the syslog.

I forget the exact message. But to test simply login unsuccessfully several times. At the same time look at the syslog for the entry.

Once you know what to look for in the syslog then write a script to grep for the entry using the static (unchanging) part of the message.

Cheers

[OFC_EDM]

As an addendum to my last post.

You can then utilize your script to forward the alert to an existing Monitoring agent such as Openview.

Openview has a command called opcmsg which you can pass parameters. opcmsg will then send the message to the Openview management server to be processed.

Alternatively just use mailx to send a message to the appropriate people.

[Kenan Erdey]

Hi,

lastb command show you bad login information. You can redirect it's output to a file.

Kenan.

[OFC_EDM]

lastb is the better option.

bad attempts may not be put in the syslog on some systems....depends on how it's setup.