syslog login needs improvements

[D Block 2]

I'm attempting to replicate what Linux (and even Solaris) can do with "login" info to Syslog.

A simple event turn-on providing "login" identification is what I wanted. I don't want to run #last or #lastb commands into /var/adm/syslog/syslog.log.

is there anyway of improving "login" events using syslog.conf entries of:
"auth.info" or "auth.note" events ?

Is there a Patch that can do this for "telnet" and "rlogin" ?

Can we somehow or some method provide simple "login" info logging on HPUX ? (I'm not interested in running TcpWrappers.) (An HP eng., suggested using #logger in /etc/profile, which sounds good, real good, but missing some info like TTY-dev and process-id.) Granted, one can obtain this data from who -T and grep'ing for tty device.. and then running #logger. but sounds like alot of work. And, what if the /etc/profile aborts due to a bad shell command, then users won't be able to login.

is there something out there, that provides a similar look and feel of output like Linux. See Linux below.

here's some notes:

Here's what Syslog contains for:
(1) Linux,
(2) Solaris.


(1) linux:

/etc/syslog.conf

entry:
auth.info /var/log/messages

- Linux succesful login event:

Sep 16 17:52:56 tivolimn1 sshd(pam_unix)[31504]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=172.16.x.y user=root


- Linux invalid login user
Sep 16 17:57:58 tivolimn1 sshd(pam_unix)[31562]: check pass; user unknown
Sep 16 17:57:58 tivolimn1 sshd(pam_unix)[31562]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=172.16.x.y
Sep 16 17:58:03 tivolimn1 sshd(pam_unix)[31562]: check pass; user unknown


(2) Solaris: for a successful login, you get:


Sep 16 17:37:31 nhsun04 login: [ID 254462 auth.notice] ROOT LOGIN /dev/pts/7 FROM 172.16.0.209

[Bill Hassell · Accepted solution]

HP-UX 11.11 uses PAM for all authentication. You can loggin options for ssh in /etc/opt/ssh/sshd_conf. For a normal login, you can add this to /etc/profile:

TTY=$(tty)
RHOST=$(who -muR | awk '{print $NF}')
UID=$(id -ur)
EUID=$(id -u)
RUSER=$(id -un)
logger -t "login-info" -p auth.info "logname=$LOGNAME uid=$UID euid=$EUID tty=$TTY ruser=$RUSER
rhost=$RHOST"

This only writes a syslog message when the user is successful in getting a login.

[D Block 2]

Bill,
glad to cya.. and thanks for the hints and details.. I'll give it a try..

btw, Solaris only provides log entry on a successful login. whereas, Linux also provides the un-successful login logging.

thanks,
Tom

[D Block 2]

Bill- thanks again. implemented this in production servers.. looks just like Linux logging to SysLog. -Tom