Monday, May 20, 2024
 Popular · Latest · Hot · Upcoming
3
rated 0 times [  3] [ 0]  / answers: 1 / hits: 2613  / 2 Years ago, mon, march 28, 2022, 4:26:00

Is there a log available where we can see login attempts, both failed and successful, for all users in 18.04 ? Also, any possible info about last logged in for a user ? Thanks.


More From » 18.04

 Answers
6

Not a single log, but successful logins are logged in /var/log/wtmp and unsuccessful ones in /var/log/btmp. These are binary files, but are readable via the last and lastb commands. From man last:




DESCRIPTION
last searches back through the /var/log/wtmp file (or the file desig‐
nated by the -f option) and displays a list of all users logged in (and
out) since that file was created.



and




       lastb is the same as last, except that by default it shows a log of the
/var/log/btmp file, which contains all the bad login attempts.






Note that access to the btmp (failed login) file is restricted for security reasons: while neither file records password strings by design, a not uncommon cause of failed logins is when users mistakenly type their password into the login field. Hence sudo is needed when running lastb.



Also note that the files are rotated - you may wish to look back through earlier logs ex.



sudo lastb -f /var/log/btmp.1

[#5164] Monday, March 28, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
wenceslockro

Total Points: 494
Total Questions: 127
Total Answers: 97

Location: Chad
Member since Mon, Dec 5, 2022
1 Year ago
;