Logging login failures

[Mxyzptlk]

Is there some way to get Merlin to log console and Web admin GUI login failures (and possibly even successes)? I've set the logging level down to debug but neither failures nor success in Admin GUI logins is showing up. This seems like a pretty basic security feature so I figured I'm just missing something...?

 

[RMerlin]

The system will log if 5 invalid login attempts occurred, triggering a 5 minutes lockout.

 

[Mike S]

It appears that someone is trying to hack my router. Every time I try to login remotely, I am getting a message that I need to wait 5 minutes to login due to prior login attempts.

Is there any way to see the IP address and user names and passwords from invalid login attempts in the router log files?

 

[EmeraldDeer]

On mine it shows IP address but not login user for web access.
For SSH access it is showing both, but only in the context of the key pair I use to login.
Passwords are not shown as you would expect for a plain text log file.

grep -E "HTTPD|dropbear" /tmp/syslog.log*

 

[scootertramp]

It appears that someone is trying to hack my router. Every time I try to login remotely, I am getting a message that I need to wait 5 minutes to login due to prior login attempts.

Is there any way to see the IP address and user names and passwords from invalid login attempts in the router log files?

Maybe you could enable firewall logging and match timestamps to see where there coming from.

info<13>1 2025-12-22T19:09:35-05:00 rt-be88u HTTPD - - [meta sequenceId="1465"] [LOGIN][https][Web] successed (xxx.xxx.xxx.xxx)
info<13>1 2025-12-22T19:08:32-05:00 rt-be88u HTTPD - - [meta sequenceId="1462"] [LOGIN][https][Web] failed (xxx.xxx.xxx.xxx)

 

[Ripshod]

Disable remote login and use VPN instead.

 

[Tech9]

Every time I try to login remotely

If you have Access from WAN enabled bots will try to login constantly. Do what @Ripshod suggests. If you run the VPN server on default port connection attempts will happen constantly. Use non-standard port.