1

I have a non-expiring service account on an AIX server which I use to connect to my database.

Every couple of weeks some user or task tries to connect to the account with the wrong password, and the account gets locked. This causes me days of delay to get the account unlocked again.

The AIX sysadmins tell me they can't track who is trying to connect. It is someone within our internal network.

Is there any way of tracking who is attempting the connection? Perhaps a log of IP addresses attempting connection?

1 Answer 1

2

I would start by translating the failedlogin file:

/usr/sbin/acct/fwtmp < /etc/security/failedlogin > /tmp/mynewfailedlogin.txt

This will give you some clues such as user, IP/hostname, date etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .