ROOT LOGIN ATTEMPTS

[Andrew Luis Arruza]

Is there a way I can tell who is trying to log into one of my servers and is making too many attempts? This, of course, disables root logins and I have to go to the console to fix.
Is there a log somewhere that will show who is making the attempts? I have already looked in the sulog and btmp but with no avail.
Thanks for any/all help. And as always points will be assigned.
Andy

[Rob Smith · Accepted solution]

Hi, if you do a lastb -R it will tell you whose logins are failing and where they are trying to login from. Hope this helps.

Rob

[Patrick Wallek]

Do a 'lastb -R | grep root'

This should give you the info you want.

[Andrew Luis Arruza]

Rob,
I tried using lastb -R on root earlier but I did not notice at the time that it looked at btmp.
Can I assume that all the login attempts in lastb -R are the failures?
Thanks

[Patrick Wallek]

lastb does display the bad login attempts.

Here is an excerpt from 'man lastb'

The lastb command searches backwards through the database file
/var/adm/btmp to display bad login information. Access to
/var/adm/btmp should be restricted to users with appropriate
privileges (owned by and readable only by root) because it may contain password information.