In the "/var/adm/ssh_logins" you will find all the executions of SSH done from your server with UIDs of the users running them. You should be able to easily grep the line that you need. After you have identified that user, you can kill dtrace process.
Thank you so much! This looks like what I need but unfortunately it requires root permissions which I do not have Anyway I have suexec permissions with grep...any way I can accomplish this with grep? I'm not familiar with dtrace but after googling it it appears to be rather complex...so I'm guessing I'd probably have to do much more than grepping to find this information?
Hi. I would like to be able to deny IP address for too many failed login attemps (either from ssh, sftp, ftp, etc). The system I wish this to work on is an AIX 5.1 system. I'm new to AIX but I'm a linux user. There is a program for linux called fail2ban which reads from the log files and see if... (1 Reply)
Hi,
I have created the below ftp script to put files over to our capacity server, the check at the end works if ftp fails to run however if the script cannot login or the transfer itself failed there is no warnings.
Does anyone know the syntax to trap the erorr codes or to put a check within... (3 Replies)
Hi,
I have a linux redhat 9 server and I am concerned about the security on that server.
I would like to be able to write a script that records all the commands that were typed at the command prompt before the user calls the 'history -c' command and deletes all the history.
I was thinking about... (4 Replies)
Dear experts,
I am seeing a lot of TCP failed connection attempts from "netstat -s" on one of our servers.
How can I pin point what connection failed and what are the ports involved?
Any tools/commands I can dig in deeper to diag. what went wrong on these "failed connection attempts"?
... (2 Replies)
I have two log files from two different days and some jobs start on one day and finish on the next. I also have jobs that start and then don't finish until other jobs start and finish. I'm trying to create a csv file with job name, start time and end time in the order that the jobs started.
... (2 Replies)
Hi All
I am having VxVm on two Solaris hosts. host1 is using disk group dgHR. right now this server went down due to hardware fault. Not I need to import this dgHR into host2 server. Please let me know the procedure for the same. (1 Reply)
The purpose of this thread is for everyone to follow the same methodology so we can create a future table, for the benefit of all, that shows how many failed login attempts (hacking) per day per server (and per minute) are happening.
This is not a thread on writing scripts or creating... (10 Replies)
Discussion started by: Neo
10 Replies
LEARN ABOUT PHP
pam_unix_auth
pam_unix_auth(5) Standards, Environments, and Macros pam_unix_auth(5)NAME
pam_unix_auth - PAM authentication module for UNIX
SYNOPSIS
pam_unix_auth.so.1
DESCRIPTION
The pam_unix_auth module implements pam_sm_authenticate(), which provides functionality to the PAM authentication stack. It provides func-
tions to verify that the password contained in the PAM item PAM_AUTHTOK is the correct password for the user specified in the item
PAM_USER. If PAM_REPOSITORY is specified, then user's passwd is fetched from that repository. Otherwise, the default nsswitch.conf(4)
repository is searched for that user. For accounts in the name services which support automatic account locking, the account may be config-
ured to be automatically locked (see user_attr(4) and policy.conf(4)) after multiple failed login attempts. If the number of successive
failures equals or exceeds RETRIES, the account is locked and PAM_MAXTRIES is returned. Currently, only the "files" repository (see
passwd(4) and shadow(4)) supports automatic account locking. A successful authentication by this module clears the failed login counter and
reports the number of failed attempts since the last successful authentication.
Authentication service modules must implement both pam_sm_authenticate() and pam_sm_setcred(). To allow replacability of the authentication
portion of UNIX authentication, pam_sm_setcred() in this module always returns PAM_IGNORE. This module should be stacked with
pam_unix_cred(5) to ensure a successful return from pam_setcred(3PAM).
The following options can be passed to the module:
nowarn Turn off warning messages.
server_policy If the account authority for the user, as specified by PAM_USER, is a server, do not apply the Unix policy from the passwd
entry in the name service switch.
nolock Regardless of the automatic account locking setting for the account, do not lock the account, increment or clear the failed
login count. The nolock option allows for exempting account locking on a per service basis.
ERRORS
The following error codes are returned from pam_sm_authenticate():
PAM_AUTH_ERR
Authentication failure.
PAM_BUF_ERR
Memory buffer error.
PAM_IGNORE
Ignores module, not participating in result.
PAM_MAXTRIES
Maximum number of retries exceeded.
PAM_PERM_DENIED
Permission denied.
PAM_SUCCESS
Successfully obtains authentication token.
PAM_SYSTEM_ERR
System error.
PAM_USER_UNKNOWN
No account present for user.
The following error codes are returned from pam_sm_setcred():
PAM_IGNORE
Ignores this module regardless of the control flag.
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
|MT Level |MT-Safe with exceptions |
+-----------------------------+-----------------------------+
SEE ALSO login(1), passwd(1), useradd(1M), usermod(1M), roleadd(1M), rolemod(1M), libpam(3LIB), pam(3PAM), pam_authenticate(3PAM), pam_set-
cred(3PAM), syslog(3C), pam.conf(4), passwd(4), policy.conf(4), nsswitch.conf(4), shadow(4), user_attr(4), attributes(5), pam_auth-
tok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_session(5)NOTES
The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.
The pam_unix(5) module is no longer supported. Similar functionality is provided by pam_authtok_check(5), pam_authtok_get(5), pam_auth-
tok_store(5), pam_dhkeys(5), pam_passwd_auth(5),pam_setcred(3PAM), pam_unix_account(5), pam_unix_cred(5), pam_unix_session(5).
If the PAM_REPOSITORY item_type is set and a service module does not recognize the type, the service module does not process any informa-
tion, and returns PAM_IGNORE. If the PAM_REPOSITORY item_type is not set, a service module performs its default action.
SunOS 5.10 2 Aug 2004 pam_unix_auth(5)
01-22-2012
Anyway I have suexec permissions with grep...any way I can accomplish this with grep? I'm not familiar with dtrace but after googling it it appears to be rather complex...so I'm guessing I'd probably have to do much more than grepping to find this information?