login error log

[Matt Rieman]

Our HP-UX 11.00 system is setup to lock out user accounts when they attempt 3 unsuccessful logins. Is there a file that logs this information, and if so, where is it located?

Thanks,

Matt

[Steve Steel]

Hi


see man last


last, lastb - indicate last logins of users and ttys


Steve Steel

[RAC_1]

You are on trusted system. Right??
The information about lock status is
retrieved as follows.

/usr/lbin/getprpw -m lockout "user_name"
The status is as follows.

1 past password lifetime
2 past last login time (inactive account)
3 past absolute account lifetime
4 exceeded unsuccessful login attempts
5 password required and a null password
6 admin lock
7 password is a *

man getprpw

anil

[HGN]

Hi

Here is the link for trusted system which has a lot of details

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90121/B2355-90121_top.html&con=/hpux/onlinedocs/B2355-90121/00/00/11-con.html&toc=/hpux/onlinedocs/B2355-90121/00/00/11-toc.html&searchterms=security%7cc2&queryid=20041022-063141

Rgds

HGN

[Muthukumar_5]

We can audit bad login informations using lastb command.

On non-trusted systems,

We have to write a script to check weather the user DID 3 bad logins at related time and date informations there. IF so lock that uer account with passwd -l


On Trusted systems,

Use RAC solutions there.

HTH.

[Bill Hassell]

Here is a script that gives extensive details about one or more user accounts. It makes use of the getprpw command and other tools.