Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I wrote a bash command to scan /var/log/auth.log for messages occurring on the current day indicating unauthorised access. Currently it just fetches messages matching BREAK-IN and unauthorized.

What other strings should I search for in /var/log/auth.log to keep tabs on unauthorized access?

Here's the script for reference:

cat /var/log/auth.log|grep "$(date|awk '{print $2" "$3}')"|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'

Edit

Here's the amended command based on Justins suggestions and what I found through Google

grep "$(date|awk '{print $2" "$3}')" /var/log/auth.log|grep -E '(BREAK-IN|Invalid user|Failed|refused|su|Illegal)'
share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

You could look for "Invalid user" which is thrown when someone tries to logon with an account that does not exist. It will also throw up "Failed password" when you enter in an invalid password.

Also, you dont need to use cat to dump the file to grep. Grep can already look at the file as its second option. 'Grep search-criteria /path/tp/file'

share|improve this answer
    
Thanks Justin, I had googled some answers actually and have amended the last grep string accordingly. Thanks for the tip on cat, it's obviously time for bed ;o) –  conorgriffin Oct 16 '10 at 1:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.