Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Solaris 2.6 failed login logging
Operating Systems Solaris Solaris 2.6 failed login logging Post 302513296 by rrossorr on Tuesday 12th of April 2011 08:44:25 PM
Old 04-12-2011
Solaris 2.6 failed login logging
Holla!

Sorry to spam the board with all my Solaris 2.6 questions (I just found this forum). My most recent problem is that not ALL failed log-ins are getting logged in /var/log/authlog. It seems to work fine for the "su" command from a non-root user, but the actual "login" command or a desktop login will not be logged.

To get this to work (in that new-fangled Solaris 8), I simply add this line to /etc/syslog.conf:

Code:
auth.info<tab><tab><tab><tab>/var/log/authlog

add these lines to the /etc/default/login file:

Code:
SYSLOG=YES
SYSLOG_FAILED_LOGINS=0
RETRIES=5

Then I add this to /etc/security/audit_control:

Code:
dir:/var/audit
flags:lo,-fr,-fd,-fm,-fc,am,ua,na
minfree:10
naflags:la

THEN, I add this to /etc/security/audit_user:

Code:
root:lo,+ex:no

I have also made sure these log files exists with the correct ownership and permissions. I have run /etc/security/bsmconv and restarted. I'm not exactly sure what every file does (it's mainly a conglomerate of suggestions I've found on the "internets") and seems to work fine in Solaris 8.

Does anyone have any suggestions to get ALL failed logins logging to /var/log/authlog?
 

10 More Discussions You Might Find Interesting

1. Solaris

how to reset failed login in solaris 8.0

hi, can someone tell me " how to reset failed login in solaris 8.0" a user is not able to login and inspite of my changing password cannot. I believe it must be because the user tried many attempts. how do i reset the failed login for the user. Thanks! karthik (2 Replies)
Discussion started by: karthikosu
2 Replies

2. Solaris

Last Failed Login

Hi, Would appreciate it if someone could shed me some light here as I'm yet to find any related information in this forum with regards to my problem. Basically, I would like to display "Last Unsuccessful login" information when a user successfully logs-in to the system. I can't seem to find... (2 Replies)
Discussion started by: gilberteu
2 Replies

3. UNIX for Advanced & Expert Users

failed ssh login with keys

Hi all, i have generated a pair of keys so that i can login via SSH without entering my password. I am using putty to login. After putting the public key on the server,then logging through putty, i get the message "Server refused our key" on screen. At the same time, /var/log/secure is... (3 Replies)
Discussion started by: new2ss
3 Replies

4. Solaris

FTP login failed.

Hi guys, Can you please help me. I have SUN V100 server running solaris 8. I also have a Redhat Linux 6.2 machine and a windows XP machine on the network. I'm trying to copy files from the Linux and XP machines to the V100 server. When I try to ftp to the solaris machine, I'm challenged... (2 Replies)
Discussion started by: Stin
2 Replies

5. UNIX for Dummies Questions & Answers

XLite and OpenIms - Login failed

Hi, I managed to install OpenImsCore and XLite, and then I tried to log in using Bob and Alice usernames, but it doesn't work. I am using Ubuntu 8.04 = Kubuntu. I tried everything I found on Google (changing security settings in HSS and scscf to Digest-MD5 was the last thing I did), but... (0 Replies)
Discussion started by: Zerro
0 Replies

6. Windows & DOS: Issues & Discussions

Application failed when remote login

I have an application (EXE file) in a Windows 2003 server. Through a DOS batch script, I called that application file using UNC path and working fine when locally login. But got failed when I tried the same batch script on remote login. The login id has been provided all the below rights: - Log on... (0 Replies)
Discussion started by: r_sethu
0 Replies

7. Solaris

Console Login Failed..

Dear Unix Team, This is sudhansu once again. I need some tips on below issue. Sometimes we got calls from customer that their console got hangged means they are not able to access the server through console ip. in that case "resetsc -y" will resolve the issue. 2. But couple of days... (2 Replies)
Discussion started by: sudhansu
2 Replies

8. Red Hat

Login failed in Redhat Enterprise 6.2

When i finished installation the Redhat Enterprise Linux 6.2, and login to the system, I can't login although username: root and Password correct. I install on the Hp Blade Server. I don't know why. How to fix this error? who can help me? :confused: Thanks! (3 Replies)
Discussion started by: dinhdangnd
3 Replies

9. Shell Programming and Scripting

How to login with other set of credentials while remote logging?

Below is the code. I need to login into the router if the 1st set of credentials are correct.. if wrong... then it has to check with 2nd set of credentials.. => if the credentials are correct... then it should continue.. => if the credentials are wrong(should not check for 2nd time... then... (0 Replies)
Discussion started by: scriptscript
0 Replies

10. Solaris

Dynamically ban ip after failed login

Hello, I need some help with network/firewall settings in Solaris 11.3. What I want to achieve is that if someone tries to log in to my server and fails I want that IP to be banned for some time. So if a computer/user tries to login to my ssh-server on a specified port (normally 22) and... (2 Replies)
Discussion started by: Zorken
2 Replies

LEARN ABOUT LINUX

pam_lastlog

PAM_LASTLOG(8)							 Linux-PAM Manual						    PAM_LASTLOG(8)

NAME

       pam_lastlog - PAM module to display date of last login

SYNOPSIS

       pam_lastlog.so [debug] [silent] [never] [nodate] [nohost] [noterm] [nowtmp] [noupdate] [showfailed]

DESCRIPTION

       pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the
       /var/log/lastlog file.

       Some applications may perform this function themselves. In such cases, this module is not necessary.

OPTIONS

       debug
	   Print debug information.

       silent
	   Don't inform the user about any previous login, just update the /var/log/lastlog file.

       never
	   If the /var/log/lastlog file does not contain any old entries for the user, indicate that the user has never previously logged in with
	   a welcome message.

       nodate
	   Don't display the date of the last login.

       noterm
	   Don't display the terminal name on which the last login was attempted.

       nohost
	   Don't indicate from which host the last login was attempted.

       nowtmp
	   Don't update the wtmp entry.

       noupdate
	   Don't update any file.

       showfailed
	   Display number of failed login attempts and the date of the last failed attempt from btmp. The date is not displayed when nodate is
	   specified.

MODULE TYPES PROVIDED

       Only the session module type is provided.

RETURN VALUES

       PAM_SUCCESS
	   Everything was successful.

       PAM_SERVICE_ERR
	   Internal service module error.

       PAM_USER_UNKNOWN
	   User not known.

EXAMPLES

       Add the following line to /etc/pam.d/login to display the last login time of an user:

	       session	required  pam_lastlog.so nowtmp

FILES

       /var/log/lastlog
	   Lastlog logging file

SEE ALSO

       pam.conf(5), pam.d(5), pam(7)

AUTHOR

       pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>.

Linux-PAM Manual						    06/04/2011							    PAM_LASTLOG(8)
All times are GMT -4. The time now is 08:59 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy