1

I'm trying to enable security logging on some HPUX11 systems.

I can get HPUX to generate a message that:

  • a login is being attempted (username, no source IP)
  • a login failed (no username or source IP)

Strangely I don't get messages for:

  • A login succeeded
  • The source IP or username of a failed login

Is there a way to tweak HPUX to give detailed information about users logging in, attempts and failures via syslog?

3
  • How are users logging on SSH or telnet, remsh etc ?
    – user14755
    Sep 28, 2014 at 23:37
  • It's a mix, they're using telnet mostly... it's an old system used to administer legacy devices on a secure network. No ssh for now. Do they all use different methods to log?
    – mgjk
    Sep 29, 2014 at 13:44
  • 1
    SSH has its own logging which is somewhat configurable. Telnet (on HP-UX) is an inetd service and is not very configurable.
    – user14755
    Sep 30, 2014 at 10:29

2 Answers 2

2
+50

While not using syslog, last and lastb both record successful and failed logins.

 # lastb -R | head -2
 fakeusr ssh:notty    192.16.999.999 Sun Sep 28 23:12
 fakeusr ssh:notty    192.16.999.999 Sun Sep 21 23:13
1
  • It's a shame it's so complex. I guess I'll have to hack something together with last, lastb, logger, awk and cron or tail. Brutal. Our wtmp and btmp files seem to be corrupt too... got to love commercial UNIX. I really appreciate the insight, just disappointed there isnt a "log to syslog" option I missed.
    – mgjk
    Oct 2, 2014 at 12:55
0

You can use faillog command to see the list of failed logins

$ faillog -h
    Usage: faillog [options]

Options:
  -a, --all                     display faillog records for all users
  -h, --help                    display this help message and exit
  -l, --lock-secs SEC           after failed login lock account for SEC seconds
  -m, --maximum MAX             set maximum failed login counters to MAX
  -r, --reset                   reset the counters of login failures
  -t, --time DAYS               display faillog records more recent than DAYS
  -u, --user LOGIN/RANGE        display faillog record or maintains failure
                            counters and limits (if used with -r, -m,
                            or -l) only for the specified LOGIN(s)

use last/lastb, faillog to find the login attempts information.

2
  • That doesn't work on any HP-UX system I've used. Is that an extra product?
    – user14755
    Oct 2, 2014 at 3:40
  • Looks like faillog is only available in linux systems. check this thread Oct 2, 2014 at 3:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.