Linux Login Auditing: Last Login Analysis and Failed Authentication Detection

Why Login Auditing Matters

Regular login auditing helps detect unauthorized access attempts, identify compromised accounts, and maintain security compliance. The lastlog system tracks when each user last authenticated.

Analyzing Last Login Data

lastlog
lastlog | grep -v "Never logged in"
last -n 20
last -f /var/log/wtmp

Detecting Failed Logins

lastb -n 20
grep "Failed password" /var/log/auth.log | tail -20
grep "authentication failure" /var/log/auth.log
journalctl _SYSTEMD_UNIT=sshd.service | grep "Failed"

Identifying Dormant Accounts

lastlog | grep "Never logged in"
# Find users with login shells who never logged in
grep -v "nologin\|false" /etc/passwd | while read line; do
  user=$(echo "$line" | cut -d: -f1)
  lastlog -u "$user" | grep "Never"
done

Automated Auditing with dargslan-lastlog-audit

pip install dargslan-lastlog-audit
dargslan-lastlog-audit
dargslan-lastlog-audit --failed
dargslan-lastlog-audit --never