Technical Tip: 'Admin login failed' log generation with SSH

Description

This article describes the behavior of how SSH login generates 'Admin login failed' log. It will only log 1 entry per SSH connection of password input.

Scope

FortiGate.

Solution

1. 2 wrong passwords have been entered twice (2 successive password inputs). Only the 1st password input will generate 'Admin login failed' login System Event. 

2. 3 wrong passwords have been entered (3 successive password inputs). Only the 1st password input will generate the 'Admin login failed' log. 'Admin log disabled' log will be generated.

3. The wrong password has been entered on every SSH Connection. 'Admin login failed' log will be generated on each SSH connection. After entering 3 wrong passwords, the Admin log will be disabled, log will be generated.

Related document:

Setting the administrator password retries and lockout time

Note: 

Take these recommendations into consideration:

• 'user' and 'password' criteria are case sensitive.
• Do not copy any blank space when pasting the 'user' or 'password'.