Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a log file or any service to report the latest login attempts which have failed due to username/password miss match. Is there such utility available for CentOS? (built-in is preferred)

My second question, and more generally, I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, httpd activities, and other conventional open ports.

share|improve this question

migrated from stackoverflow.com Sep 22 '12 at 9:19

This question came from our site for professional and enthusiast programmers.

2  
answer to second question: take a look at OSSEC. –  quanta Sep 22 '12 at 10:49
1  
This thread is moved from Stackoverflow after I asked the question in Serverfault. Here is the threads discussing the second question. –  ahmad Sep 22 '12 at 10:58

2 Answers 2

up vote 1 down vote accepted

The question is here offtopic, but a very short answer: maybe you should just check /var/log/secure (e.g. grep for "failed").

share|improve this answer
    
It is actually the answer to my first question. I'll ask the second in ServerFault. Thanks. –  ahmad Sep 22 '12 at 7:41

In Linux, the last command shows successful login attempts and displays session information (pts, source, date and length).

The lastb command records all bad login attempts. Both share the same man page, but the difference is that last reads the binary /var/log/wtmp file, and lastb reads the /var/log/btmp file by default.

The range of these files depends on your log rotation schedule, but it should span a few weeks. Most distributions will rotate /var/log/wtmp monthly, so you can read a previous record, usually listed as /var/log/wtmp.1 by specifying the file with the -f parameter... last -f /var/log/wtmp.1

share|improve this answer
    
+1 for the lastb –  ahmad Sep 23 '12 at 11:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.