Unsuccessfully login

[Shehan]

Hi All
I want to track the ip address of unsuccessfully login from root account. Please let me know how can we find it in hp-ux 11.11i

Regards
Nirukshitha

[Shrikant Lavhate]

unsucessful login logs resides under /var/adm/btmp.

[Pete Randall]

Use "lastb root".


Pete

[Jeeshan]

this is not readble file with "cat" or "more"

you can use

#strings /var/adm/btmp

[MarkSyder]

Try /usr/sbin/acct/fwtmp < /var/adm/btmp|grep root

This will include the ip address.

Mark Syder (like the drink but spelt different)

[James R. Ferguson]

Hi:

There is no requirement that '/var/adm/btmp' be present. If it isn't, then no recording of failed logins via this file will be available.

You can create 'btmp' if it doesn't exist in order to start logging. If you need to do this, simply 'touch' the file, but change its permissions to be read/writeable ONLY by 'root' for security. It may contain password information from mangled login attempts.

Another file that may offer a record of unsuccessful attempts to login to 'root' is the '/var/adm/sulog'. Unsucesssul transitions are noted with a '-'; successful ones with a '+'. An unsuccessful 'su' from me to root looks like:

SU 01/03 09:46 - tb jrf-root

Regards!

...JRF...
Regards!

...JRF...