0

I wish to include a count of failed login attempts whenever a user logs in.

I've created:

/usr/local/bin/dynmotd

which contains

#!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG "

and added /usr/local/bin/dynmotd to /etc/profile

The issue is I get /var/log/faillog: Permission denied

whenever I login as a regular user. Is there a way to either safely temporarily escalate privileges to run that command on the motd, or temporarily give that user access to faillog to get that response? I don't want to give all user access to faillog permanently.

UPDATE

Tried this:

#!/bin/bash CURRENTUSER=`whoami` sudo -u bob setfacl -m u:$CURRENTUSER:rx /var/log/faillog FAILLOG=`sudo -u bob faillog -u $CURRENTUSER` echo -e " $FAILLOG "

Add added 'bob' to the sudoers with NOPASSWD:, this works fine when I'm logging in as 'bob' but if I try and login as 'bob2' I get asked for the sudoers password.

Improve this question
6
  • Seeing the message permission denied I think you can setfacl -m u:username:r /var/log/faillog to grant read access to the particular user. Commented Jul 22, 2014 at 12:02
  • Adding setfacl -m u:'whoami':rx /var/log/faillog gives me a setfacl: /var/log/faillog: Operation not permitted Commented Jul 22, 2014 at 14:27
  • setfacl should be run as root user. 'whoami' is not as whoami and you should not use it there. Instead use a real username you want to grant read privileges to that file. Commented Jul 22, 2014 at 14:45
  • Tried running it as sudo, as I can't run it as root as the user won't know (or be allowed) the root password. Updated question. Commented Jul 22, 2014 at 15:07
  • Seems you don't understand what I'm trying to explain. You first need to be root then grant read permissions to a particular user for example to kiksy. You don't need to modify the script. It will be able to read the file. Commented Jul 22, 2014 at 15:14

1 Answer 1

Reset to default
1

I would suggest creating a script that runs as root. Have it run hourly, writing the output of 'faillog -a' to a text file everyone has access to. Then have your MOTD grep that file for the current user. This would avoid having to make any unnecessary permissions changes or granting someone sudo access that doesn't need it.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.