User Authentication

[Bharat Katkar]

How can i trace users login attempts and any unauthorised attempts made to access the server. I must be able to monitor IP address with time stamp of the client system who is trying to log in. How do i configure and what is the procedure for the same?

[Paula J Frazer-Campbell]

Hi

Last, last -b see man last also check sulog

Paula

[Massimo Bianchi]

Hi,
to have full tracing and auditing you must trust your system, but this can have side effects.


If you just want to monitor:

from man 1m login:

/var/adm/btmp History of bad login attempts
/var/adm/wtmp History of logins, logouts, and date changes

you can query this file with the "last" command


Other information can be found in the /var/adm/syslog/syslog.log.

In the end, you can trace remote connetion modifying the /etc/inetd.conf enabling the loggin options for each program.

For the exact option, i suggest a good "man program", i don't know them all.


HTH,
Massimo

[Bala_11]

Hi,

#last -R
#lastb -R

should help you

[Rainer von Bongartz · Accepted solution]

If you want an off-line trace you can use last/lastb -R.

If you want an on-line trace with active alarms of intrusions you should install IDS/9000 from HP which comes for free from

www.software.hp.com

Regards
Rainer