How to detect login failure followed by root password change in linux?

[KSPriya]

Hello, fellow splunkers!

What I am trying to do is to detect a failed login attempts followed by root password change in linux with correlation search or datamodel search?

[inventsekar]

@KSPriya ... Please suggest us...

1. do you use Splunk_TA_nix or not

2. do you want to monitor for the root user or any user?.. because, linux users generally login with their user access and then do the sudo to become root., right.. so you might want to monitor user login failures, right.. or sudo commands you want to monitor.. 

best regards,

Sekar

[KSPriya]

Hello sekar,

Good day!!!

Thanks for your reply. Below are my comments:

1. do you use Splunk_TA_nix or not - we are not using Splunk_TA_nix

2. do you want to monitor for the root user or any user?.. because, linux users generally login with their user access and then do the sudo to become root., right.. so you might want to monitor user login failures, right.. or sudo commands you want to monitor.. - ---That's correct we can't directly access sudo user, but i'm looking is for sudo/root password reset attempts after multiple user login failures.

Regards,

Kspriya

[inventsekar · Accepted solution]

Hi Priya, with the "Splunk App for Unix and Linux", this will be an easy task.. without this App, you have to everything manually. 

ok, first lets try to monitor the folder /var/log/secure (the splunk user should have access to read this folder) and then once the logs reach Splunk, then you can check all details like login successful as well as failures and then you can drill down to the real issue of root user login failures(sudo failures).

[KSPriya]

Thanks for the update champ