[SOLVED] Viewing Failed Login attempts

[bct]

Hi everyone.
Can someone point me in the direction of a log that records logins to the PMG interface (Failed and successful).
Hoping it also records the IP address of the login attempts.
Thanks!!

 

[t.lamprecht]

Hi,

for failed only you can use the general /var/log/daemon.log, where you will see failed logins like:
Apr 28 07:39:18 mg6dev pmgdaemon[1302]: authentication failure; rhost=192.168.1.42 user=root@pam msg=...

It is almost identical to how Proxmox VE logs this, so you could reuse its wiki for fail2ban, if you want something like that:
https://pve.proxmox.com/wiki/Fail2ban

For successful logins you can use the API proxy log, and scan for POST requests to /api2/extjs/access/ticket or /api2/json/access/ticket to observe new ticket creations. The log is located at /var/log/pmgproxy/pmgproxy.log (and log-rotated monthly, so older versions are archived for 12 months).

# grep all tries, successful or failed:
grep -P 'POST /api2/[^/]+/access/ticket' /var/log/pmgproxy/pmgproxy.log

# grep only successful tries (HTTP response code 200 (OK))
grep -P '"POST /api2/[^/]+/access/ticket HTTP/[\d.]+" 200' /var/log/pmgproxy/pmgproxy.log

There you've got all information relevant for a basic audit: date, IP, API path and HTTP method.

 

[bct]

Thank You Stoiko! Much appreciated

 

[vinet]

/var/log/daemon.log does not exist in my proxmox 8.0.4

 

[Stoiko Ivanov]

/var/log/daemon.log does not exist in my proxmox 8.0.4

You can get the same information from the system journal - see `man journalctl`

But PMG should still have rsyslog installed - and in the default configuration it should still log to daemon.log - could you please share:
* /etc/rsyslog/rsyslog.conf
* dpkg -l |grep syslog

 

[vinet]

https://www.thomas-krenn.com/de/wiki/Ablösung_von_/var/log/syslog_durch_journalctl_in_Debian_12

or apt install rsyslog

solved my PRoblem