User Locked Out Log

[Dummy_Guy]

Hi all,
I am using HP UX11.0. For auditing purposes, I really like to find out how often each user exceed the login attempt (ie. Locked out). Is there any log available? or is there anyway we can capture the information using scripts?

[Steven E. Protter]

passwd -sa

That might show locked users.

A script that reads /var/adm/btmp will get you a list of users that have failed login too many times.

SEP

[saju_2]

Hi john

There are mainly 3 files which contains the login informations.

/etc/utmp --contains a record of all users logged onto the system

/var/adm/btmp--contains bad login entries for each invalid logon attempt

/var/adm/wtmp--contains a record of all logins and logouts

Also from /var/adm/syslog/syslog u can get the information of the users logged into to the server or failed logon attempts.


Regards
CS

[Dummy_Guy]

I know what utmp, btmp and wtmp are.

My real problem is, I can't tell how many time a user been locked in a month. I can capture how many bad password entered during the month but I can't tell how many time they been locked out.

passwd -sa can tell me who are the user currently locked out but can't tell me from the history point of view.

I need to know so I can tell whether intruder was attempting to login.

[Adisuria Wangsadinata_1]

Hi,

Actually you can get the information that you want by combine both information (from 'utmp, btmp and wtmp' and 'passwd -sa').

From here, at least you will find the trend which user is 'always' forgot about his/her password.

Because the different between 'the intruder was attempting to login' and 'the user that always forgot about their password' is very little. But you can prevent this by looking on the fact, one of them is by looking on the trend.

Hope this information can help you.

Cheers,
AW