I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed login: Fri May 24 03:58:45 EDT 2019 from x.x.x.x on ssh:notty
There were 121 failed login attempts since the last successful login.
Last login: Thu May 23 15:52:24 2019 from x.x.x.x
Then I installed fail2ban to prevent these attempts, and after that the line reporting the number of failed logins is gone. At first I thought maybe these bots have decided to not try to login to my machine anymore and there was really no failed login attempts, so the message is gone. But then I realized
lastb shows a lot of recent attempts. I tried to have a look at
/var/log/secure but the file does not exist anymore.
As I understand
/etc/pam.d/postlogin is responsible to show this message at login. Here is the content of that file:
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp showfailed session optional pam_lastlog.so silent noupdate showfailed
How do I find out what caused this change? And how do I get that message back?