Security Strategies in Linux Platforms and Applications, 3rd Edition
by Ric Messier, Michael Jang
Tracking Access Through Logs
Linux supports logging for services and the kernel. Until recently, this was configured in two different service daemons, syslogd and klogd, in the /sbin/ directory. The latest versions of Linux include a successor, the /sbin/rsyslogd daemon, though some Linux distributions may use the syslog-ng package instead of rsyslog. The functionality has not changed. The system and kernel logs are so intertwined, they’re usually part of the same package, rsyslog or sysklogd. In either case, Ubuntu and Red Hat take different approaches to logging configurations from this file.
This section focuses on tracking access—that is, finding those log files that record login attempts and especially login failures. These services classify ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access