Solaris

Holla!

Sorry to spam the board with all my Solaris 2.6 questions (I just found this forum). My most recent problem is that not ALL failed log-ins are getting logged in /var/log/authlog. It seems to work fine for the "su" command from a non-root user, but the actual "login" command or a desktop login will not be logged.

To get this to work (in that new-fangled Solaris 8), I simply add this line to /etc/syslog.conf:

Code:

auth.info<tab><tab><tab><tab>/var/log/authlog

add these lines to the /etc/default/login file:

Code:

SYSLOG=YES
SYSLOG_FAILED_LOGINS=0
RETRIES=5

Then I add this to /etc/security/audit_control:

Code:

dir:/var/audit
flags:lo,-fr,-fd,-fm,-fc,am,ua,na
minfree:10
naflags:la

THEN, I add this to /etc/security/audit_user:

Code:

root:lo,+ex:no

I have also made sure these log files exists with the correct ownership and permissions. I have run /etc/security/bsmconv and restarted. I'm not exactly sure what every file does (it's mainly a conglomerate of suggestions I've found on the "internets") and seems to work fine in Solaris 8.

Does anyone have any suggestions to get ALL failed logins logging to /var/log/authlog?

Well, first of all welcome to our site. You are welcome to post all of the Solaris 2.6 questions you want. But even Solaris 8 is obsolete at this point. I will move your questions to the Solaris forum where they are more likely to be noticed by our Solaris experts.

look here

Summary: Failed Login Attempts

Thanks for the link Solaris_User. I have seen that thread before, and if you read through it you will see that most of what I did was exactly the same as what I have posted. Also, I noticed that the thread really didn't have any resolution to the problem.

Yeah, but thread says and then backs up this comment by quoting the man page which documents the behavior present in Solaris 2.6.