![Forrest logo](/images/logo.png)
lastb:tldr:5fd20
The command "sudo lastb --dns" is used to display the records of failed login attempts on a system, along with the associated DNS information.
Here is a breakdown of the command:
-
"sudo": It is a command that allows a user to execute a command as a superuser or another user. In this case, it is used to run the "lastb" command with elevated privileges.
-
"lastb": It is a command that displays information about failed login attempts by examining the records stored in the "/var/log/btmp" (or "wtmp") file. It provides details such as the user attempting the login, the source IP address, the date and time of the attempt, and more.
-
"--dns": This option is specific to the "lastb" command. By including "--dns", the command will resolve the IP addresses from the records into their corresponding domain names using DNS lookup. This can be useful for identifying the origin or source of the failed login attempts based on the domain names rather than just IP addresses.
Therefore, running the "sudo lastb --dns" command will generate a list of failed login attempts, showing the associated DNS information for each IP address that attempted the login.