Log of failed authentication attempts

Is there a way to configure a log that will show what username and password credentials were provided when attempting to log into a linux machine and failing?

Ergo, can I see what people are trying to use to log into a linux box that they are not supposed to be logging into?
LVL 32
DrDamnitAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
jianmcgowanConnect With a Mentor Commented:
There should be a log of failed login attempts in /var/log/auth.log.  I don't think there's any way to display the passwords - that would be horrible from a security perspective.

Something like honeyd, http://www.honeyd.org, might be a useful thing to research if you think you have internal people up to no good.  It can log all packets sent and received, presumably including the passwords tried.

Hope this helps,
Ian
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.