Command library / lastb

Show failed login attempts

The failed-login counterpart of last: it reads /var/log/btmp, where the system records every rejected login attempt, and prints which account was tried, from where and when. A burst of failures against one account, or from one address, is the classic sign of password guessing. It needs root, because btmp is readable only by root.

Usage

Options and flags

• username

  show only failed attempts against this account

• -n, --limit N

  show only the last N entries

• -i, --ip

  show the source as an IP address instead of a host name

• -F, --fulltimes

  print full dates and times, including the year and seconds

Examples

• lastb -n 20

  The 20 most recent failed login attempts.

• lastb admin

  Every rejected attempt against the admin account.

• lastb -i

  Failed attempts with each source shown as a numeric IP address.

Common mistakes

Related commands