How to: Configure Linux to track and log failed login attempt recoreds

[webscott]

Under Linux you can use faillog command to display faillog records or to .set login failure limits. faillog formats the contents of the failure log from /var/log/faillog database / log file. It also can be used for maintains failure counters and limits. Run faillog without arguments display only list of user faillog records who have ever had a login failure.

Under RHEL / CentOS Linux 5.x, you need to modify /etc/pam.d/system-auth file. You need to configure PAM module pam_tally.so. Otherwise faillog command will never display failed login attempts.

PAM Configuration to recored failed login attempts.

pam_tally.so module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail.
Open /etc/pam.d/system-auth file

# vi /etc/pam.d/system-auth

Append following two pam_tally.so modules:

auth required pam_tally.so no_magic_root
account required pam_tally.so deny=3 no_magic_root lock_time=180

Where,

* deny=3 : Deny access if tally for this user exceeds 3 times.
* lock_time=180 : Always deny for 180 seconds after failed attempt. There is also unlock_time=n option. It allow access after n seconds after failed attempt. If this option is used the user will be locked out for the specified amount of time after he exceeded his maximum allowed attempts. Otherwise the account is locked until the lock is removed by a manual intervention of the system administrator.
* magic_root : If the module is invoked by a user with uid=0 the counter is not incremented. The sys-admin should use this for user launched services, like su, otherwise this argument should be omitted.
* no_magic_root : Avoid root account locking, if the module is invoked by a user with uid=0

Save and close the file.

How to check all failed login attempts for user test ?

You need to use faillog command to display faillog records:

# faillog -u test

Display faillog records for all users.

# faillog -a