unix account disabled

[Sanjiv Sharma_1]

Hi,

HP-UX 11.11
My password policy is when a user types his password wrong for the third time then his unix account will be disabled. It has been observed that his account is getting disabled very frequently and I have to reactivate it.
This user knows the correct password and hence he is not the culprit.

Is there a way to identify who else is trying to hijack his unix account "jerry"?

Thanks in advance,

[Warren_9]

hi,

enable inetd logging:
in /etc/rc.config.d/netdaemons,
export INETD_ARGS="-l"

restart the inetd and the telnet session will then log in syslog.

compare the output of lastb and the syslog to find out from which machine try to login that account.

also, you may also need to check the su log, /var/adm/sulog.

[Rajeev Shukla]

Thats right, first thing is enable the connection loging in ineted by using inetd -l command at the command prompt as root.
You should see people accessing this account, could be either telnet or ftp.
Now what i have experienced is that even if the ftp password is wrongly supplied couple of times can actually disable the account.
So see in syslog who actually is accessing this account.(you'll see the IP address or host of the culprit)

[Patrick Wallek]

This is a good use of the "lastb" command. Do a "lastb -R userid" (where userid is your users id). The -R will show the IP address or system name that the invalid login attempt came from. That will allow you to get closer to who is disabling the id.


# lastb -R jerry

# man lastb

for more info.

[morganelan]

I think last -R and lastb -R command in HPUX are not enough to do:

- Monitor accounts and when users log in/out of the system.
- Monitor accounts and what creations/updates/deletions they may perform on the system.

Beside those command i think you must be helped by other tools such as :

-Openview from HP
-Big Brother http://www.bb4.org
-Sitescopes from mercury http://www.mercury.com/us/products/application-management/foundation/monitors/sitescope/

[Ranjith_5]

Hi Raje,

lastb -R |grep will give you the details of the bad logins. These information is taken from /var/adm/btmp file. /var/adm/btmp is the bad login database file.

Regards,
Syam