Can bad logins be filtered....

From: George Gallen <ggallen_at_slackinc.com>
Date: Mon, 16 Apr 2001 12:06:50 -0400

I have tcpwrappers setup to only allow in certain IP, however, for one
group, I have
to only use the first IP part (ie. 206.) as allowable only because the ISP
for that
block (not 206, but another one) doesn't give static IP's so I have to allow
all of them
through tcpwrappers.

What I want to do is when a login attempt fails, if it's IP source is
external I wan't more
than a second chance at login, I also want an email. Is there anyway to do
that.

Since the sialog file doesn't give much info on a bad login, it would be
very difficult
to trace it back, especially, if there were no successful logins to compare
the tty
to using last. Is there a way to tell the IP address of a failed login
attempt?

I can't put it in tcpwrappers, since it doesn't know the login name yet, and
I can't
put in the .login files, since the login isn't successful.

Thanks
George



George Gallen
Senior Programmer/Analyst
Accounting/Data Division
ggallen_at_slackinc.com
ph:856.848.1000 Ext 220

SLACK Incorporated - An innovative information, education and management
company
http://www.slackinc.com
Received on Mon Apr 16 2001 - 16:08:08 NZST

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:42 NZDT