Failed User Login
Enabled by default
Service: syslog
Log type: auth.log
Failed user logins can show possible password spray and password guessing attacks. Not every failed login is an attack, but they can be early indicators of one. This log is required by the PCI DSS regulation.
View Logs
grep failure /var/log/auth.log
Check Logging Status
Unfortunately, due to current limitations, we do not yet have this command, stay tuned for updates!
Disable Logging
Unfortunately, due to current limitations, we do not yet have this command, stay tuned for updates!
Enable Logging
Unfortunately, due to current limitations, we do not yet have this command, stay tuned for updates!
Language: bash
Back to Linux UbuntuCompliance
HIPAA
Level: Recommended
NSA Event Forwarding
Level: Recommended
https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Events
Linux calls this log authentication failure. To view this log in the GNOME logs viewer, search in the security tab for authentication or failure.
In order to view this log from the command line, enter the command grep failure /var/log/auth.log. If there are other failures in the auth.log, replace failure in the command with “authentication failure”.
Additional References
View this article on GitHub