What file are failed logins stored? 1

[gabryael]

I've recently hardened the system and I'm wondering where the failed logins are stored. On hp systems, its in btmp. Where is it on a sco box?

 

[pcunix]

See
/tcb/lib/report.login

man report.login Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com

 

[gabryael]

Thanks, but what let's say I am malicious user gibson and I try to login into server scobox. I don't have an account on scobox, but I give it a try anyway. Where will my failed login attempts be logged?

 

[pcunix]

Well, they aren't going to be anywhere by default.

I'm trying to remember something..

Oh boy, the brain is coming up empty.. nope, there it is

You can create an empty file in /usr/adm/loginlog

The bad login has to be several times- I forget how many or if you can change the default, and I'm not sure if it is doc'd anywhere.
Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com