lastb Command in Linux

Introduction

In this guide, we will delve into the Linux lastb command, a crucial tool for system administrators to monitor unsuccessful login attempts. The lastb command is invaluable for identifying potential security breaches and tracking user activity, enabling systemadmin and security experts to bolster system security.

Our exploration begins with understanding the core function of the lastb command, followed by a detailed examination of its syntax and available options. Finally, we'll analyze the output generated by lastb to spot patterns in failed login attempts and implement necessary security precautions.

Understand the Purpose of the lastb Command

In this section, we will dissect the purpose of the lastb command within the Linux environment. Specifically, the lastb command serves to present data concerning failed login attempts on your system.

The information provided by the lastb command is critical for system administrators and security professionals to proactively identify possible security risks and oversee user behavior on the system.

Let's initiate this process by executing the lastb command:

sudo lastb

Example output:

labex   tty1                         Fri Apr 14 12:34:56 2023 - Fri Apr 14 12:35:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:33:51 2023 - Fri Apr 14 12:34:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:32:46 2023 - Fri Apr 14 12:33:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:31:41 2023 - Fri Apr 14 12:32:01 2023 (00:00)

The output displays essential details such as the username, terminal, login timestamp, and duration of each failed login attempt. This data can reveal patterns indicative of security threats, like unauthorized access attempts targeting the system.

Explore the Syntax and Options of the lastb Command

In this part, we will investigate the syntax and different options available for the lastb command.

The fundamental structure of the lastb command is:

sudo lastb [options] [username]

Here are a few of the frequently used options for the lastb command:

  • -a: Show the hostname or IP address of the remote host.
  • -d: Display comprehensive information about the login session, including the terminal and login/logout times.
  • -f: Display the full username, inclusive of the domain name.
  • -n <number>: Display the last <number> of failed login attempts.
  • -p: Display the PID (process ID) of the login process.
  • -R: Change the order of the output, displaying the newest failed login attempts at the top.

Let's experiment with some of these options:

## Display the last 5 failed login attempts with details
sudo lastb -d -n 5

## Display the failed login attempts with the hostname or IP address
sudo lastb -a

## Reverse the order of the output
sudo lastb -R

Example output:

labex   tty1                         Fri Apr 14 12:34:56 2023 - Fri Apr 14 12:35:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:33:51 2023 - Fri Apr 14 12:34:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:32:46 2023 - Fri Apr 14 12:33:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:31:41 2023 - Fri Apr 14 12:32:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:30:36 2023 - Fri Apr 14 12:31:01 2023 (00:00)

The output demonstrates the different types of information obtainable through the various options of the lastb command.

Analyze Failed Login Attempts Using the lastb Command

In this concluding step, we'll discover how to analyze the data provided by the lastb command to recognize potential security vulnerabilities and monitor user actions on the system.

First, let's create some additional failed login attempts to enrich our analysis dataset:

## Simulate some failed login attempts
for i in {1..5}; do
  sudo su - -c "echo 'wrong password' | su - labex"
done

Now, let's employ the lastb command to examine the failed login attempts:

## Display the last 10 failed login attempts
sudo lastb -n 10

Example output:

labex   tty1                         Fri Apr 14 12:34:56 2023 - Fri Apr 14 12:35:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:33:51 2023 - Fri Apr 14 12:34:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:32:46 2023 - Fri Apr 14 12:33:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:31:41 2023 - Fri Apr 14 12:32:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:30:36 2023 - Fri Apr 14 12:31:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:29:31 2023 - Fri Apr 14 12:30:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:28:26 2023 - Fri Apr 14 12:29:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:27:21 2023 - Fri Apr 14 12:28:01 2023 (00:00)
root    tty1                         Fri Apr 14 12:26:16 2023 - Fri Apr 14 12:27:01 2023 (00:00)
labex   tty1                         Fri Apr 14 12:25:11 2023 - Fri Apr 14 12:26:01 2023 (00:00)

The output reveals numerous failed login attempts for both the labex and root users. This could point towards a potential security intrusion or unauthorized access attempts.

To delve deeper into the analysis of these failed login attempts, we can enhance our use of the lastb command with extra options:

## Display the failed login attempts with the hostname or IP address
sudo lastb -a

## Display the failed login attempts in reverse order
sudo lastb -R

By carefully examining the output from the lastb command, you can spot patterns like the usernames, terminals involved, and the timing of these attempts. This insight is vital for implementing effective security strategies to safeguard your system.

Summary

In this guide, we've explored the application and importance of the lastb command in Linux. It serves as an essential tool for displaying information about failed login attempts, aiding system administrators and security teams in detecting security threats and monitoring user behavior.

We learned how to execute the lastb command to view critical data like usernames, terminals, login timestamps, and the duration of failed login attempts. We also investigated several options for the lastb command, such as displaying the hostname or IP address, detailed login session information, and specifying the number of failed attempts to show. These functions are key for thoroughly analyzing security events on your system and responding effectively.

400+ Linux Commands