Login attempt notification

[Bruce Baillie_1]

I am trying to write a script that will notify me if there has been a failed
login attempt. Just a simple look at /var/adm/btmp time stamp every few minutes
and send me mail or open a window telling me of the failed login.

[Alan Riggs_1]

This is hardly refined, but you should be able t adapt the logic to your needs:

#!/bin/ksh
THEN=`ll /var/adm/btmp|awk '{printf("%s %s %s",$6,$7,$8)}'`
while [ true ]
do
NOW=`ll /var/adm/btmp|awk '{printf("%s %s %s",$6,$7,$8)}'`
if [ "$THEN" != "$NOW" ]
then
THEN=$NOW
elm -s "Bad login on `hostname`" user@domain <Bad login recorded at $NOW
END
fi
sleep 120
done

[Bruce Baillie_1]

Alan,
Thanks for your help, it was exactly what I was looking for. Now I can tell
when security scans my systems for vulnerabilities.
Out of all the newsgroups and conferences I use daily, this one has been the
most helpful. Good job HP.
Bruce