How to log failed login attempts (Ubuntu)

  • Login: Attempted login user
  • Failures: Failed login attempts
  • Maximum: Allowed login failures before disabling the account
  • Latest: Date and time of last failed login
  • On: Where the failed login occurred

Step 1 – Enable pam_tally.so in /etc/pam.d/common-auth

Add the following lines to the top of the file:

 

Step 2 – Enable pam_tally.so in /etc/pam.d/sshd

Add the following lines immediately beforeĀ  @include common-auth:

 

Step 3 – Enable PAM inĀ /etc/ssh/sshd_config

Step 4 – Restart ssh

One thought on “How to log failed login attempts (Ubuntu)

Leave a Reply