Is there a log available where we can see login attempts, both failed and successful, for all users in 18.04 ? Also, any possible info about last logged in for a user ? Thanks.
Not a single log, but successful logins are logged in
/var/log/wtmp and unsuccessful ones in
/var/log/btmp. These are binary files, but are readable via the
lastb commands. From
DESCRIPTION last searches back through the /var/log/wtmp file (or the file desig‐ nated by the -f option) and displays a list of all users logged in (and out) since that file was created.
lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.
Note that access to the
btmp (failed login) file is restricted for security reasons: while neither file records password strings by design, a not uncommon cause of failed logins is when users mistakenly type their password into the login field. Hence
sudo is needed when running
Also note that the files are rotated - you may wish to look back through earlier logs ex.
sudo lastb -f /var/log/btmp.1
There is a package called "audit". You can install it with:
sudo apt install auditd
Then you will need to start and enable it to start at boot:
sudo systemctl start audit sudo systemctl enable audit
All login attempt whether successful or not will log to /var/log/auth.log (ssh logins are already logged there as well). Also the package has a reporting ability:
Successful attempts summary:
aureport -l --success --summary -i | less
Failed attempts report:
aureport -au -i --failed | less
You can swap "--failed" with "--success" or vice-versa in the above commands.