root login attempt

[John McDen]

How do I know which user(s) tried to login as root ?? is there a place it logs the login attempts??

[Pete Randall · Accepted solution]

su to any other user is recorded in syslog. I don't think logins are, though.

Pete

[MANOJ SRIVASTAVA]

Hi John

/var/adm/sulog is the file which has the information , genreally in the format

SU date time <+/-> user name su name

+ if the user was suceeful
- if the user was not sucessful

we have disabled logins to even root , oracle so that we can track down using sulog as who su ing .


Manoj Srivastava

[John McDen]

Thanks ...pete

[harry d brown jr]

If a user tries to login as root, then the username will showup as root, not their actual name or username.

I would suggest only allowing root to login from the console, and then disable the login by typing in the password wrong until it reashes the "disable" limit.


live free or die
harry

[T G Manikandan]

Check the
/var/adm/sulog
(the log file for the successful and failure attempts for su)

root logins with ipaddress can be had from the wtmp file.
YOu can check for the ipaddress that other than yours for the root logins.

use fwtmp command to change the wtmp file to ascii and check it out.

fwtmp /tmp/wtmp.ascii

Thanks

[Helen French]

Hi John:

Check these files:
/var/adm/sulog - su information
/var/adm/syslog/syslog.log
/var/adm/wtmp - logins
/var/adm/btmp - bad logins

and these commands:

# last
# lastb

HTH,
Shiju