0

What are the commands for seeing Successful and Unsuccessful login events in Ubuntu 14.04.5?

I tried aureport -au -i --success and aureport -au -i --failed , but I don't know what the code 133, 129 etc. mean there?

Result for <code>aureport -au -i --failed</code>

Improve this question
11
  • Those look like attempt or event numbers as they are in order. What about looking at entries in the /var/log/auth.log file?
    – Terrance
    Nov 2, 2017 at 16:39
  • 1
    You can try cat /var/log/auth.log | grep -i failed which will show the failed attempts and what IP they came from. And I believe that you can use cat /var/log/auth.log | grep -i "session opened" for successful attempts.
    – Terrance
    Nov 2, 2017 at 17:31
  • 1
    cat /var/log/auth.log | grep lightdm:auth returns nothing on my host. I get better results with failure though.
    – Terrance
    Nov 2, 2017 at 21:24
  • 1
    By the way, failed does return failed login attempt like Nov 2 13:57:31 terrance-ubuntu sshd[12685]: Failed password for invalid user admin from 97.82.62.143 port 54075 ssh2
    – Terrance
    Nov 2, 2017 at 21:27
  • 1
    @AndrewShum Ah, I see now. I am not worried about physical security on my hosts as they automatically log in. There is no lightdm:auth on the hosts because of that reason. Regardless, it is the point of looking in the file for anything out of the ordinary, and if OP does have ssh enabled, it would be good to know if someone or thing is trying to access the host as well.
    – Terrance
    Nov 2, 2017 at 21:39

2 Answers 2

Reset to default
3

The application you are using is fine for checking those. aureport comes in the auditd package and is not installed by default.

The columns in the report as as follows:

date time acct host term exe success event

Showing on my system if I run it without the --success or --failed it will show all:

terrance@terrance-ubuntu:~$ sudo aureport -au -i
[sudo] password for terrance:           

Authentication Report
============================================
# date time acct host term exe success event
============================================
1. 11/02/2017 16:37:45 terrance ? /dev/pts/2 /usr/bin/sudo yes 90
2. 11/02/2017 16:39:14 terrance ? /dev/pts/2 /usr/bin/sudo yes 243

The success column is what shows if my login was successful or not. As we can see on this one, both attempts at logging in were successful (yes). The number on the last part of each line is just the event number at which it happened. These numbers can be ignored. It is all the information before it that is important.

Improve this answer
1

As suggested by @MichaelBay, I am reposting this as an answer. See the comments on the original post for the full conversation.

I suggest a modification to the solution proposed by @Terrance. First, failed attempts don't use "failed"; they use "failure". Second, using "session opened" will return more than just user sessions.

If you use cat /var/log/auth.log | grep lightdm:auth, you will get both successful and failed attempts. This assumes you are not interested in ssh/tty logins. To get successful ones only, cat /var/log/auth.log | grep "lightdm:auth): r". For failed ones only, cat /var/log/auth.log | grep "lightdm:auth): a".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .