Which files must be edited in order to set up logging of all failed login attempts?
A.
/etc/default/login, /var/adm/loginlog, /etc/syslog.conf
B.
/etc/default/login, /var/adm/authlog, /etc/syslog.conf
C.
/var/adm/loginlog, /var/adm/authlog, /etc/syslog.conf
D.
/etc/default/login, /var/adm/authlog, /var/adm/loginlog
Explanation:
This procedure captures in a syslog file all failed login attempts.
1.Set up the /etc/default/login file with the desired values for SYSLOG and
SYSLOG_FAILED_LOGINS
Edit the /etc/default/login file to change the entry. Make sure that SYSLOG=YES is uncommented.
2. Create a file with the correct permissions to hold the logging information.Create the authlog file
in the /var/adm directory.
3. Edit the syslog.conf file to log failed password attempts.
Send the failures to the authlog file.
Reference: Oracle Solaris 11 Information Library, How to Monitor All Failed Login Attempts
B
I think it’s A
Why would you need to edit /var/adm/authlog?
Authlog will hold the logging information. Reference for you Oliver, Monitoring failed login attempts – http://docs.oracle.com/cd/E23824_01/html/821-1456/secsys-40.html#secsys-26
B
This procedure captures in a syslog file all failed login attempts.
1. Set up the /etc/default/login file with the desired values for SYSLOG and
SYSLOG_FAILED_LOGINS
Edit the /etc/default/login file to change the entry. Make sure that SYSLOG=YES is uncommented.
2. Create a file with the correct permissions to hold the logging information.
Create the authlog file in the /var/adm directory.
3. Edit the syslog.conf file to log failed password attempts.
Send the failures to the authlog file.
Reference: Oracle Solaris 11 Information Library, How to Monitor All Failed Login Attempts
B