I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:

Last failed login: Fri May 24 03:58:45 EDT 2019 from x.x.x.x on ssh:notty
There were 121 failed login attempts since the last successful login.
Last login: Thu May 23 15:52:24 2019 from x.x.x.x

Then I installed fail2ban to prevent these attempts, and after that the line reporting the number of failed logins is gone. At first I thought maybe these bots have decided to not try to login to my machine anymore and there was really no failed login attempts, so the message is gone. But then I realized lastb shows a lot of recent attempts. I tried to have a look at /var/log/secure but the file does not exist anymore.

As I understand /etc/pam.d/postlogin is responsible to show this message at login. Here is the content of that file:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed

How do I find out what caused this change? And how do I get that message back?


My Fedora has a man page for pam_tally2 which says it counts attempted accesses. As well as the module, there is a command of the same name to lookup current values in /var/log/tallylog, but I don't see any entries in there. However, you can try

sudo pam_tally2 -u myusername
| improve this answer | |
  • Thanks. It's strange that this command does not report any failed attempts on my machine. Anyway, my goal is to put this information in ssh banner. More accurately, I want to find out what made this information disappear from the banner, because previously it was there and I whatever I did, I didn't intend to remove it. – Nima May 24 '19 at 20:08

For failed login attempts can be found in /var/log/secure

Below is the example

 host-1-193 sshd[1644]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
May 24 18:23:46 host-1-193 sshd[1644]: Failed password for root from port 29021 ssh2
May 24 18:23:49 host-1-193 sshd[1644]: Accepted password for root from port 29021 ssh2
May 24 18:23:49 host-1-193 sshd[1644]: pa
| improve this answer | |
  • Thanks, but I think you missed the part of the question that says /var/log/secure does not exist. – Nima May 24 '19 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.