--------------070705060506040409000100 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Thank you to all who replied. I am running Solaris 2.6. What it worked for me was: ================== Failed attempts show up as daemon.info messages. In /etc/syslog.conf I have added: daemon.info /var/log/daemons. Failed attempts show up as two lines: Mar 1 05:00:01 int sshd[25941]: log: Connection from 172.17.128.108 port 1023 Mar 1 05:00:07 int sshd[25941]: fatal: Connection closed by remote host. What it didn't work was loginlog. ===================== I did: # touch /var/adm/loginlog - it did not exist before # chmod 0600 /var/adm/loginlog # chown root:sys /var/adm/loginlog I added also the line in /etc/syslog.conf: auth.notice /var/adm/loginlog I've changed the /etc/default/login: RETRIES=1 SYSLOG=YES SYSLOG_FAILED_LOGINS=0 # ps -ef | grep syslogd -> get <syslogd-PID> # kill -HUP <syslogd-PID> Nothing, no failed login attempts come to /var/adm/loginlog at all. Maybe I'm missing something or maybe loginlog works only for Solaris 8 - I'm using Solaris 2.6. Here is my original post: ================ Hi Admins, What should be done to log the failed login attempts. Telnet is disabled, I'm using ssh1. Loginlog is not usefull if there are less than 5 failed attempts. # man loginlog "Reformatting page. Wait... done File Formats loginlog(4) NAME loginlog - log of failed login attempts After five unsuccessful login attempts, all the attempts are logged in the file /var/adm/loginlog." Here are the replies: ============= SEDEVAUX@bouyguestelecom.fr =========================== Hie, try BSM (Basic Security Module) with 'lo' flag in /etc/security/audit_control (see man man bsmconv) regards; Sbastien Devaux Administrateur Systme - DOR/OSD Blue Consulting / Bouygues Tlcom Email : sedevaux@bouyguestelecom.fr <mailto:sedevaux@bouyguestelecom.fr> Carl Schelin <cschelin@hq.nasa.gov ================================== Failed attempts show up as daemon.info messages. I have daemon.info pointing to /var/log/daemons. Failed attempts show up as two lines: Feb 27 08:32:15 xxxx sshd[2833]: log: Connection from xxx.xxx.xxx.xxx port 1020 Feb 27 08:32:15 xxxx sshd[2833]: fatal: Connection closed by remote host. Carl Schelin Geoff Lane <zzassgl@twirl.mcc.ac.uk> =================================== The "5 failed attempts" refers to 5 attempts to enter a correct password at the password prompt during a single connection. Not a total of 5 attempts to login over time. Make sure that /var/adm/loginlog exists otherwise it will not be written to. -- /\ Geoff. Lane. /\ Manchester Computing /\ Manchester /\ M13 9PL /\ England /\ Davorin Bengez <dbengez@interactive1.hr> ======================================== Hi, sshd may or may not use login itself. try man sshd... look for directives in configuration file (mine is actually OpenSSH, but it should be similar at least): - what will be logged: LogLevel Gives the verbosity level that is used when logging messages from sshd. The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. The default is INFO. Logging with level DEBUG vio lates the privacy of users and is not recommended. - how will it be logged: SyslogFacility Gives the facility code that is used when logging messages from sshd. The possible values are: DAEMON, USER, AUTH, LOCAL0, LO CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de fault is AUTH. also, note configuration of your syslog daemon... Hope that helps, davor -- Davorin Bengez UNIX Systems Administrator and IT Security Manager Email: dbengez@interactive1.hr <mailto:dbengez@interactive1.hr> Tel/Fax: +385 1 363 4403 GSM: +385 91 36 88 501 Key fingerprint = F679 A232 683E 5848 ABD5 BF9D 8A98 B05F D1CF 1E5B Simon-Bernard Drolet <simon@learnix.com> ======================================== Hi Marco, You need to edit the file /etc/default/login and look for these: # SLEEPTIME controls the number of seconds that the command should # wait before printing the "login incorrect" message when a # bad password is provided. The range is limited from # 0 to 5 seconds. # #SLEEPTIME=4 # RETRIES determines the number of failed logins that will be # allowed before login exits. # #RETRIES=5 # # The SYSLOG_FAILED_LOGINS variable is used to determine how many failed # login attempts will be allowed by the system before a failed login # message is logged, using the syslog(3) LOG_NOTICE facility. For example, # if the variable is set to 0, login will log -all- failed login attempts. # #SYSLOG_FAILED_LOGINS=5 You set RETRIES and SYSLOG_FAILED_LOGINS to let says 3, after three tries, this info will be log to /var/adm/loginlog. NOTE: make sur eloginlog is really 0600 and root:sys. Simon. Matt Schepens <Matt.Schepens@entrust.com> ========================================= The only method I know of is to modify the /etc/default/login file. This file allows you to specify how many attempts the machine will allow before it logs it. Unfortunately, this is only true for Solaris 8, from what I've seen. Solaris 7 only seems to allow you to choose whether or not the failed login attempts are logged by the syslog daemon. There must be other ways to log failed attempts on a Solaris 7, if that's what you're using. Best of luck, Matt system administration account <sysadmin@astro.su.se> ==================================================== You could simply look at the logs from your sshd. (I hope you've built it with PAM support. Then you could also supply your own PAM module for additional logging. But in any event, I find that authentication failures are logged by sshd. Maybe you just need to edit /etc/syslog.conf to send the logs to the right place.) Paul Hedgepeth <hedgepethp@yahoo.com> ===================================== marco, in /etc/syslog.conf: uncomment the auth.notice line. later, paul Thanks again, Marco --------------070705060506040409000100 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <html><head></head><body>Thank you to all who replied.<br> <br> I am running Solaris 2.6.<br> <br> What it worked for me was:<br> ==================<br> Failed attempts show up as daemon.info messages. <br> <br> In /etc/syslog.conf I have added:<br> daemon.info /var/log/daemons. <br> <br> Failed attempts show up as two lines: <br> Mar 1 05:00:01 int sshd[25941]: log: Connection from 172.17.128.108 port 1023<br> Mar 1 05:00:07 int sshd[25941]: fatal: Connection closed by remote host.<br> <br> What it didn't work was loginlog.<br> =====================<br> I did:<br> # touch /var/adm/loginlog - it did not exist before<br> # chmod 0600 /var/adm/loginlog<br> # chown root:sys /var/adm/loginlog<br> <br> I added also the line in /etc/syslog.conf:<br> auth.notice /var/adm/loginlog<br> <br> I've changed the /etc/default/login:<br> RETRIES=1<br> SYSLOG=YES<br> SYSLOG_FAILED_LOGINS=0<br> <br> # ps -ef | grep syslogd -> get <syslogd-PID><br> # kill -HUP <syslogd-PID><br> <br> Nothing, no failed login attempts come to /var/adm/loginlog at all.<br> Maybe I'm missing something or maybe loginlog works only for Solaris 8 - I'm using Solaris 2.6.<br> <br> Here is my original post:<br> ================<br> Hi Admins, <br> <br> What should be done to log the failed login attempts. <br> Telnet is disabled, I'm using ssh1. <br> <br> Loginlog is not usefull if there are less than 5 failed attempts. <br> <br> # man loginlog <br> "Reformatting page. Wait... done <br> <br> File Formats loginlog(4) <br> <br> NAME <br> loginlog - log of failed login attempts <br> After five unsuccessful login attempts, all the attempts are logged in the file /var/adm/loginlog." <br> <br> Here are the replies:<br> =============<pre><a class="moz-txt-link-abbreviated" href="mailto:SEDEVAUX@bouyguestelecom.fr">SEDEVAUX@bouyguestelecom.fr</a><br>===========================<br></pre> <pre wrap="">Hie, try BSM (Basic Security Module) with 'lo' flag in /etc/security/audit_control (see man man bsmconv) regards; Sébastien Devaux Administrateur Système - DOR/OSD Blue Consulting / Bouygues Télécom Email : <a class="moz-txt-link-abbreviated" href="mailto:sedevaux@bouyguestelecom.fr">sedevaux@bouyguestelecom.fr</a> </pre> <pre>Carl Schelin <<a class="moz-txt-link-abbreviated" href="mailto:cschelin@hq.nasa.gov">cschelin@hq.nasa.gov</a><br>==================================<br></pre> Failed attempts show up as daemon.info messages. I have daemon.info pointing to /var/log/daemons. Failed attempts show up as two lines: <br> <br> Feb 27 08:32:15 xxxx sshd[2833]: log: Connection from xxx.xxx.xxx.xxx port 1020 <br> Feb 27 08:32:15 xxxx sshd[2833]: fatal: Connection closed by remote host. <br> <br> Carl Schelin<br> <pre><br>Geoff Lane <a class="moz-txt-link-rfc2396E" href="mailto:zzassgl@twirl.mcc.ac.uk"><zzassgl@twirl.mcc.ac.uk></a><br>===================================<br><pre wrap="">The "5 failed attempts" refers to 5 attempts to enter a correct password at the password prompt during a single connection. Not a total of 5 attempts to login over time. Make sure that /var/adm/loginlog exists otherwise it will not be written to. <div class="moz-txt-sig">-- /\ Geoff. Lane. /\ Manchester Computing /\ Manchester /\ M13 9PL /\ England /\ <pre>Davorin Bengez <a class="moz-txt-link-rfc2396E" href="mailto:dbengez@interactive1.hr"><dbengez@interactive1.hr></a><br>========================================<br><pre wrap="">Hi, sshd may or may not use login itself. try man sshd... look for directives in configuration file (mine is actually OpenSSH, but it should be similar at least): - what will be logged: LogLevel Gives the verbosity level that is used when logging messages from sshd. The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. The default is INFO. Logging with level DEBUG vio­ lates the privacy of users and is not recommended. - how will it be logged: SyslogFacility Gives the facility code that is used when logging messages from sshd. The possible values are: DAEMON, USER, AUTH, LOCAL0, LO­ CAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The de­ fault is AUTH. also, note configuration of your syslog daemon... Hope that helps, davor <div class="moz-txt-sig">-- Davorin Bengez UNIX Systems Administrator and IT Security Manager Email: <a class="moz-txt-link-abbreviated" href="mailto:dbengez@interactive1.hr">dbengez@interactive1.hr</a> Tel/Fax: +385 1 363 4403 GSM: +385 91 36 88 501 Key fingerprint = F679 A232 683E 5848 ABD5 BF9D 8A98 B05F D1CF 1E5B<br><pre><br>Simon-Bernard Drolet <a class="moz-txt-link-rfc2396E" href="mailto:simon@learnix.com"><simon@learnix.com></a><br>========================================<br><pre>Hi Marco, You need to edit the file /etc/default/login and look for these: # SLEEPTIME controls the number of seconds that the command should # wait before printing the "login incorrect" message when a # bad password is provided. The range is limited from # 0 to 5 seconds. # #SLEEPTIME=4 # RETRIES determines the number of failed logins that will be # allowed before login exits. # #RETRIES=5 # # The SYSLOG_FAILED_LOGINS variable is used to determine how many failed # login attempts will be allowed by the system before a failed login # message is logged, using the syslog(3) LOG_NOTICE facility. For example, # if the variable is set to 0, login will log -all- failed login attempts. # #SYSLOG_FAILED_LOGINS=5 You set RETRIES and SYSLOG_FAILED_LOGINS to let says 3, after three tries, this info will be log to /var/adm/loginlog. NOTE: make sur eloginlog is really 0600 and root:sys. Simon.</pre><br>Matt Schepens <a class="moz-txt-link-rfc2396E" href="mailto:Matt.Schepens@entrust.com"><Matt.Schepens@entrust.com></a><br>=========================================<br></pre><p><font size="2">The only method I know of is to modify the /etc/default/login file. This file allows you to specify how many attempts the machine will allow before it logs it. Unfortunately, this is only true for Solaris 8, from what I've seen. Solaris 7 only seems to allow you to choose whether or not the failed login attempts are logged by the syslog daemon.</font></p><p><font size="2">There must be other ways to log failed attempts on a Solaris 7, if that's what you're using.</font></p><p><font size="2">Best of luck,</font><br><font size="2">Matt</font></p><pre><pre>system administration account <a class="moz-txt-link-rfc2396E" href="mailto:sysadmin@astro.su.se"><sysadmin@astro.su.se></a><br>====================================================<br></pre></pre><div class="moz-text-plain" wrap="true" graphical-quote="true" style="truefont-size: 13px; "><pre wrap="">You could simply look at the logs from your sshd. (I hope you've built it with PAM support. Then you could also supply your own PAM module for additional logging. But in any event, I find that authentication failures are logged by sshd. Maybe you just need to edit /etc/syslog.conf to send the logs to the right place.)<br><br><pre>Paul Hedgepeth <a class="moz-txt-link-rfc2396E" href="mailto:hedgepethp@yahoo.com"><hedgepethp@yahoo.com></a><br>=====================================<br><pre wrap="">marco, in /etc/syslog.conf: uncomment the auth.notice line. later, paul<br><br><br>Thanks again,<br>Marco<br></pre></pre> </pre></div> </div></pre></pre></div></pre></pre> </body></html> --------------070705060506040409000100--Received on Thu Mar 1 13:30:59 2001
This archive was generated by hypermail 2.1.8 : Wed Mar 23 2016 - 16:34:34 EDT