How to monitor failed login attempts in Linux

One of the things administrators often do is check multiple failed login attempts in Linux. Monitoring them allows you to assess whether illegal or unwanted attempts to our network have occurred. In this article, we will show you how to track it automatically using NetCrunch.

Configuring RHEL and Debian based Linuxes

The first thing you need to do to monitor login attempts is to configure Linux properly. We'll show you how to do this on the example of Debian and RHEL based systems. If your Linux is not configured, you will first need to install Audit. How to do it? Most Linuxes have an Audit repository included in the official repositories. So just use the simple commands:

• for Debian based systems: sudo apt-get install auditd
• for RHEL based systems: sudo yum install audit

The Audit daemon should start automatically, but if it didn't happen for some reason, use the following commands:

• for Debian based systems: sudo systemctl start auditd
• for RHEL based systems: sudo systemctl start audit

After configuring the system, the logs should be saved in these locations:

• for Debian based systems: /var/log/auth.log
• for RHEL based systems: /var/log/secure

Of course, you can try to read files using commands such as more, less or grep. Unfortunately, log files are not very easy to read, therefore NetCrunch will be much more efficient and convenient to achieve it. Just take a moment to configure, and then NetCrunch will automatically inform you if there are any suspicious login attempts.

Create Text Parsing Expression

The logs that we want to monitor contain a lot of interesting information. You can check in them, among others, whether there were any failed login attempts, successful login attempts, and many more. For the purposes of this article, we will create Text Parsing Expression, using Regular Expression, which allows to easily find the phrase 'authentication failure' in the following entry in the log:

Jun 3 12:32:29 debian gdm3] [3544]: pam_unix (gdm3: auth): authentication failure; logname = uid = 0 euid = 0 tty =: 0 ruser = rhost = user = test

1. From the Top Menu select Monitoring Text Parsing Expressions
2. Click Text Log Expressions button
3. Click +Add button located in the bottom-left corner of the window
4. Enter any Name and select Regular Expression Type
5. In the Test Text field paste a single line of the log
6. In the Regular Expression field write proper expression, in our example it should be(\w{3}\s{2}\d) (\d{2}:\d{2}:\d{2}) (.*): (.*)
7. In the Variables section click +Add button 4 times, and name your variables (e.g. Date, Time, Info, Message)
8. Click OK button to save settings

If you've done everything correctly, in the seventh step, values should appear next to the variable names:

If you would like to search for other log entries, you will most likely have to create a new Text Parsing Expression.

Add Text Log sensor to the Linux Node

A good way to save yourself a job (especially if you have or plan to have many Linux nodes that you want to monitor) is to create the appropriate Template. Please refer to one of the previous articles on templates - read it if you are not familiar with template usage scenarios yet. Here I will focus on adding the right sensor directly to the node.

1. Open Node Settings on the appropriate Node
2. Click on + Add Monitoring Sensor button and add the Text Log sensor
3. Configure all settings
4. Add New Alert on Text Log Entry
5. Enter alert description and set filtering condition to Message contains authentication failure
6. Save all settings

Usually illegal attempts are not a single failed login event, but rather a series of them in a short time. So to actually track illegal attempts, you should select Event happened more than in the Trigger Alerting Action On section of Alerting Rule window, and set the number of occurrences per unit of time according to your needs.

automaticdynamicmonitoringsensortemplatetext parsing expressionview