36

I'm looking for a log file or any service to report the latest login attempts that have failed due to username/password mismatch. Are there any such utilities available for CentOS? (built-in is preferred)

My second question, and more generally, I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, httpd activities, and other conventional open ports.

  • 2
    answer to second question: take a look at OSSEC. – quanta Sep 22 '12 at 10:49
  • 1
    This thread is moved from Stackoverflow after I asked the question in Serverfault. Here is the threads discussing the second question. – lashgar Sep 22 '12 at 10:58
69

In Linux, the last command shows successful login attempts and displays session information (pts, source, date and length).

The lastb command records all bad login attempts. Both share the same man page, but the difference is that last reads the binary /var/log/wtmp file, and lastb reads the /var/log/btmp file by default.

The range of these files depends on your log rotation schedule, but it should span a few weeks. Most distributions will rotate /var/log/wtmp monthly, so you can read a previous record, usually listed as /var/log/wtmp.1 by specifying the file with the -f parameter... last -f /var/log/wtmp.1

| improve this answer | |
  • 18
    +1 for the lastb – lashgar Sep 23 '12 at 11:36
  • 3
    This should be the selected answer – a coder Jan 18 '17 at 13:19
  • @acoder, done :thumb: – lashgar May 10 '19 at 18:16
14

The question is here offtopic, but a very short answer: maybe you should just check /var/log/secure (e.g. grep for "failed").

| improve this answer | |
  • It is actually the answer to my first question. I'll ask the second in ServerFault. Thanks. – lashgar Sep 22 '12 at 7:41
1

This is a old thread but I got similar task like this,so in my case this is a log entry

Nov 15 17:14:47 megatron sshd[4768]: Failed password for git from 192.168.122.1 port 49227 ssh2

So we can do it like this,if we are sure user is static

#!/bin/bash
LOG=/var/log/secure
MESSAGE="Failed password for git"
grep -i "$MESSAGE" "$LOG

In case if we know on the per user basis

#!/bin/bash
LOG=/var/log/secure
if [ -n "$1" ]
then
NEWUSER="$1"
else
NEWUSER="root"
fi
MESSAGE="Failed password for $NEWUSER"
grep -i "$MESSAGE" "$LOG"

So script should execute like

[root@megatron bash1]# ./failedlogin.sh git

OR more easier approach

#!/bin/bash
LOG=/var/log/secure
MESSAGE="Failed password for"
grep -i "$MESSAGE" "$LOG"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.