Hi! Thank you to everybody who helped. What I actually want, is something like: wank login: weinberg Password: 1 failure since last login. Last was 11:43:51 on 7. , which I get with telnet/rlogin, but not with ssh. Logging under /var/log is not the problem. A quick look in sshd.c shows, that sshd itself does not read /var/log/faillog. if (!options.use_login && command == NULL && last_login_time != 0 && !quiet_login) { /* Convert the date to a string. */ time_string = ctime(&last_login_time); /* Remove the trailing newline. */ if (strchr(time_string, '\n')) *strchr(time_string, '\n') = 0; /* Display the last login time. Host if displayed if known. */ if (strcmp(buf, "") == 0) printf("Last login: %.100s\r\n", time_string); else printf("Last login: %.100s from %.200s\r\n", time_string, buf); } But sshd can call /bin/login: (UseLogin = yes in /etc/sshd_config) #ifdef USELOGIN else { execl(PATH_LOGIN, "login", "-h", remote_ip, "-p", "-f", "--", user_name, NULL); /* NOTREACHED */ } #endif /* USELOGIN */ I hoped, this will help, but still, I do not get the faillog during login. Regarding security, I think it would be a good idea to add /var/log/faillog support for sshd. Regards, Volker Weinberg