On Saturday 13 October 2007 16:56, JB2 wrote:
Say I click on the 'lock' button on the taskbar (the one above the system on/off button). The screen goes black and if I hit a key on the keyboard or move the mouse, a small window pops up asking me for the user password.
How do I find out if someone has tried to 'log in'? Even if they hit a key on accident or moves the mouse on accident, does the system log this too? If it's in a log somewhere, will it be easily human readable?
How do we really know the synthesizer of this message is human?? Anyway, in /var/log/messages (accessible only by root), unsuccessful login and unlock attempts (including those via ssh, which will often yield long traces of remote password-guessing break-in attempts) are recorded. Here's the result of a test in which I gave an invalid password twice and then gave the correct one: Oct 13 17:04:14 twain kcheckpass[17151]: Authentication failure for rschulz (invoked by uid 1000) Oct 13 17:04:21 twain kcheckpass[17157]: Authentication failure for rschulz (invoked by uid 1000)
JB
Randall Schulz -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org