Friday, March 24, 2006

Find all failed login attempts in linux

If you are using ssh for remote connection then following command will help to trace out all failed login attempts
As root user type this
# grep "authentication failure" /var/log/messages|awk '{ print $13 }' | cut -b7- | sort | uniq -c

No comments: