[BlueOnyx:11276] Re: show all login failures?

[Gerald Waugh]

On 09/05/2012 08:13 AM, Roy Urick wrote:
>
> We started seeing the host blocks kick in yesterday against the IP of
> our corporate firewall.
>
>  
>
> At first we thought it was the conversion we are doing and that the
> server running popcon was causing failures due to accounts with bad
> passwords. However when I tail the maillog and grep for "(auth failed"
> the number of failures doesn't match the failure count on the server
> gui. The server is reporting approximately 2-3 failed logins for every
> auth failed line we see in the maillog.
>
>  
>
> I have dug around the other logfiles in that directory and don't see
> any other failed login references. Also the gui doesn't seem to pace
> the errors in maillog exactly as its incrementing faster than the
> logfile.
>
>  
>
> Where else do I look to figure out what could be causing the login
> failures?
>
>  
>
look at /var/log/secure

Gerald
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20120905/a8940dda/attachment.html>