How to log failed login attempt
Under Linux you can use faillog command to display faillog records or to .set login failure limits. faillog formats the contents of the failure log from /var/log/faillog database / log file. It also can be used for maintains failure counters and limits. Run faillog without arguments display only list of user faillog records who have ever had a login failure.
PAM Settings
I found that under RHEL / CentOS Linux 5.x, you need to modify /etc/pam.d/system-auth file. You need to configure PAM module pam_tally.so. Otherwise faillog command will never display failed login attempts.
PAM Configuration to recored failed login attempts
pam_tally.so module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail.
Open /etc/pam.d/system-auth file:
Category: Linux Administration
Subscribe
If you enjoyed this article, subscribe to receive more just like it.
