Skip to content

Authentication - Login

Authentication - Login Authentication - Login

Introduction

Authentication - Login events record every attempt to access an IRF1000/IRF3000 device via the web UI, JSON‑RPC, or Adsdpd. The event helps you demonstrate who tried to log in, from where, and with which result. It also covers explicit logouts and sessions that ended because of an idle timeout. Watch for repeated auth-failed, invalid-user, netsource-mismatch, and session-limit reasons. Investigate source changes for the same session hash and restrict access to trusted IP or MAC addresses. Use strong passwords and keep the login‑ban feature active to slow down brute‑force attempts.

Webinterface View

The VIEW web interface shows Authentication audit entries in a single table. This table combines USER_LOGIN, USER_LOGOUT, and USER_END events into one view. The Session column displays the first four characters of the session hash. Method shows web (including JSON‑RPC) or adsdpd. During an active login‑ban period, additional failed login attempts are not added to this table.

For each row, the columns are mapped as follows:

Field Description Example
Date Local date when the event was written 10/14/25
Time Local time when the event was written 08:21:05
Username Account name from the attempt; for failed logins this is the attempted name admin
Action Taken High‑level action derived from the audit type and op fields logged-in; logged-out; idle-timeout
Session First four characters of the session hash (maps to terminal in the log) d4ec
Method Login interface that created the event web; adsdpd
Source Origin address of the request. IP address for web, MAC address for adsdpd 192.168.0.40; 86:b7:75:70:0a:6d
Reason Reason string. For failures it shows the cause from the log (for example invalid-user); for successful logins the UI displays success invalid-user; auth-failed; netsource-mismatch; session-limit; success
Result Outcome of the action success; failed

Explanation of the raw audit.log entry

Each Authentication - Login related line in audit.log is a Linux audit record written by rpcd. For SIEM integration, focus mainly on the structured fields inside msg='…'. Generic auditd‑internal fields should be interpreted according to the official auditd documentation.

Field Description Example
type Audit record type. For this view: USER_LOGIN, USER_LOGOUT, USER_END USER_LOGIN
msg=audit(ts:seq) Auditd timestamp and sequence number audit(1760430052.348:23)
pid Process ID that emitted the event (auditd‑internal) 5447
uid Real UID (auditd‑internal) 0
auid Audit UID (auditd‑internal) 4294967295
ses Audit session ID (auditd‑internal) 4294967295
msg='op=…' Structured payload from rpcd, containing the fields below op=user-login …
op Action keyword. Examples: user-login, user-session-limit, session-access-mismatch-net_src user-login
acct Username used in the attempt admin; invalid-user
exe Source component of the request web; adsdpd
hostname Not used by this product ?
addr Source address. IP address for web, MAC address for adsdpd 192.168.0.40; 86:b7:…
terminal First four characters of the SHA‑256 hash of the session ID d4ec
id / ID Session identifier if present. May be unset in some records 4294967295; unset
reason Reason string on failures invalid-user; auth-failed; netsource-mismatch; session-limit
res Result of the action success; failed

SIEM tips:

  • Parse at least type, op, acct, exe, addr, terminal, reason, and res.
  • Alert on many auth-failed or invalid-user results from the same source, on any netsource-mismatch, and on surges of session-limit events per user.
  • Remember that during a login‑ban, additional failed attempts are not logged; correlate with other lockout or ban telemetry if available.

When the event is generated

The device generates Authentication - Login related audit records whenever the rpcd process authenticates a user or ends a session.

  • type=USER_LOGIN is emitted on each authentication attempt via web (including JSON‑RPC) or Adsdpd. On success res=success and the reason field in the raw log is empty. On failure res=failed and reason contains the cause, for example invalid-user, auth-failed, netsource-mismatch, or session-limit. During an active login‑ban period, additional failed attempts are not logged.
  • type=USER_LOGOUT is emitted when a user explicitly logs out from a session.
  • type=USER_END is emitted when the device terminates a session because of an idle timeout.

The rpcd process creates and tracks sessions and calls audit_log_acct_message() from libaudit to write these records into audit.log. For web and JSON‑RPC access the source address is an IP address. For Adsdpd the source address is a MAC address because it is a Layer‑2 request. The terminal value is the first four characters of the SHA‑256 hash of the session ID.

Sample audit.log entry

(1) type=USER_LOGIN msg=audit(1760430025.988:20): pid=5447 uid=0 auid=4294967295 ses=4294967295 msg='op=user-login acct="admin" exe="adsdpd" hostname=? addr=86:b7:75:70:0a:6d terminal=f171 reason= res=success'UID="root" AUID="unset"
(2) type=USER_LOGIN msg=audit(1760430052.348:23): pid=5447 uid=0 auid=4294967295 ses=4294967295 msg='op=user-login acct="admin" exe="web" hostname=? addr=192.168.0.40 terminal=d4ec reason= res=success'UID="root" AUID="unset"

(1) type=USER_LOGIN msg=audit(1760422861.352:32): pid=5446 uid=0 auid=4294967295 ses=4294967295 msg='op=user-login acct="invalid-user" exe="web" hostname=? addr=192.168.0.40 terminal=? reason="invalid-user" res=failed'^]UID="root" AUID="unset"
(2) type=USER_LOGIN msg=audit(1760422865.716:33): pid=5446 uid=0 auid=4294967295 ses=4294967295 msg='op=user-login acct="admin" exe="web" hostname=? addr=192.168.0.40 terminal=? reason="auth-failed" res=failed'^]UID="root" AUID="unset"
(3) type=USER_LOGIN msg=audit(1760422882.944:35): pid=5446 uid=0 auid=4294967295 ses=4294967295 msg='op=session-access-mismatch-net_src id=4294967295 exe="web" hostname=? addr=172.16.0.40 terminal=? reason="netsource-mismatch" res=failed'^]UID="root" AUID="unset" ID="unset"
(4) type=USER_LOGIN msg=audit(1760422924.180:55): pid=5446 uid=0 auid=4294967295 ses=4294967295 msg='op=user-session-limit acct="admin" exe="web" hostname=? addr=192.168.0.40 terminal=? reason="session-limit" res=failed'^]UID="root" AUID="unset"
(5) type=USER_LOGIN msg=audit(1760423232.724:79): pid=5446 uid=0 auid=4294967295 ses=4294967295 msg='op=user-login acct="admin" exe="adsdpd" hostname=? addr=86:b7:75:70:0a:6d terminal=? reason="auth-failed" res=failed'UID="root" AUID="unset"