AIX

 View Only
Expand all | Collapse all

can I stop failed ssh logins being logged to /etc/security/failedlogin?

  • 1.  can I stop failed ssh logins being logged to /etc/security/failedlogin?

    Posted Fri November 15, 2019 12:55 PM

    Originally posted by: SamRoberts


    I don't actually care that people ***failed*** to login with ssh, that's why we have only public key auth allowed by ssh...

     

    I do care that my root filesystem periodically overflow. Can I stop the failed logins being logged?

     

    Thanks,

    Sam



  • 2.  Re: can I stop failed ssh logins being logged to /etc/security/failedlogin?

    Posted Mon November 18, 2019 10:54 AM

    Originally posted by: AncientAIXer


    That is not a standard location.  I believe that ssh will log into syslog.  You should check syslog.conf and either change the location to /var/… or you can use the entries to exclude the facility and level, but you may not be able to restrict the exclude to just ssh.