i was wondering if a GUI login attempt with a non existing username will be written to any log files? (im using mint with cinnamon and Kali with gnome3)

I accidentally put my password in as username and hit enter and now i want to know if my password is stored anywhere in cleartext, like it would be for an incorrect login via ssh in /var/log/auth.log

  • The ` login` program from the shadow package had a check put in back in 2007 to explicitly catch this and not log anything other than a valid user account name, with a fixed string used in place of any other username input, for logging failed logins. So in part the question is whether this idea has carried over to your choice of GUI login program. – JdeBP Jan 28 at 14:34

Use the command lastb to check the bad login attempts. The bad logins are stored under the /var/log/btmp file. To erase the content of the file use:


manpages : lastb

lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.


You can verify this by looking in to logs. Try this one:

grep -r "your_P4Ssw0rd_here" /var/log/*

Empty result should make you happy.

  • assuming that you have root privileges on it
  • 3
    Doing this will result in having the password also stored in the commands' history. – jayooin Jan 28 at 14:50
  • ... and possibly in the auth.log itself, if the OP has to elevate their privileges to grep within it :) – steeldriver Jan 28 at 15:00
  • Although, if you're using bash and put some whitespace at the beginning of the line, it does not go into the .bash_history file. Does show in a ps while the command is running. – doneal24 Jan 28 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.