diff -Nur kdebase-3.5.8.orig/kdm/backend/client.c kdebase-3.5.8/kdm/backend/client.c
--- kdebase-3.5.8.orig/kdm/backend/client.c	2007-11-21 09:53:07.000000000 +0200
+++ kdebase-3.5.8/kdm/backend/client.c	2007-11-21 10:00:10.000000000 +0200
@@ -86,6 +86,14 @@
 #include "consolekit.h"
 #endif
 
+#define  AU_FAILED 0
+#define  AU_SUCCESS 1
+#ifdef HAVE_LIBAUDIT
+#include <libaudit.h>
+#else
+#define log_to_audit_system(l,h,d,s)	do { ; } while (0)
+#endif
+
 /*
  * Session data, mostly what struct verify_info was for
  */
@@ -290,6 +298,56 @@
 {}
 # endif
 
+ /**
+ * log_to_audit_system:
+ * @login: Name of user
+ * @hostname: Name of host machine
+ * @tty: Name of display 
+ * @success: 1 for success, 0 for failure
+ *
+ * Logs the success or failure of the login attempt with the linux kernel
+ * audit system. The intent is to capture failed events where the user
+ * fails authentication or otherwise is not permitted to login. There are
+ * many other places where pam could potentially fail and cause login to 
+ * fail, but these are system failures rather than the signs of an account
+ * being hacked.
+ *
+ * Returns nothing.
+ */
+
+#ifdef HAVE_LIBAUDIT
+static void 
+log_to_audit_system (const char *loginname,
+		     const char *hostname,
+		     const char *tty,
+		     int success)
+{
+	struct passwd *pw;
+	char buf[64];
+	int audit_fd;
+
+	audit_fd = audit_open();
+	if (loginname)
+		pw = getpwnam(loginname);
+	else {
+		loginname = "unknown";
+		pw = NULL;
+	}
+	Debug("log_to_audit %p %s\n", pw, loginname);
+
+	if (pw) {
+		snprintf(buf, sizeof(buf), "uid=%d", pw->pw_uid);
+		audit_log_user_message(audit_fd, AUDIT_USER_LOGIN,
+			buf, hostname, NULL, tty, (int)success);
+	} else {
+		snprintf(buf, sizeof(buf), "acct=%s", loginname);
+		audit_log_user_message(audit_fd, AUDIT_USER_LOGIN,
+			buf, hostname, NULL, tty, (int)success);
+	}
+	close(audit_fd);
+}
+#endif
+
 static int
 doPAMAuth( const char *psrv, struct pam_data *pdata )
 {
@@ -348,6 +406,8 @@
 		GSendStr( curuser );
 	}
 	if (pretc != PAM_SUCCESS) {
+	        /* Log the failed login attempt */
+	        log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 		switch (pretc) {
 		case PAM_USER_UNKNOWN:
 		case PAM_AUTH_ERR:
@@ -698,6 +758,8 @@
 	if (!p->pw_uid) {
 		if (!rootok && !td->allowRootLogin)
 			V_RET_FAIL( "Root logins are not allowed" );
+		/* Log the failed login attempt */
+		log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 		return 1; /* don't deny root to log in */
 	}
 
@@ -734,6 +796,8 @@
 			}
 			if (pretc == PAM_SUCCESS)
 				break;
+			/* Log the failed login attempt */
+			log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 			/* effectively there is only PAM_AUTHTOK_ERR */
 			GSendInt( V_FAIL );
 		}
@@ -823,6 +887,8 @@
 				GSendInt( V_MSG_ERR );
 				GSendStr( "Your account has expired;"
 				          " please contact your system administrator" );
+				/* Log the failed login attempt */
+				log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 				GSendInt( V_FAIL );
 				LC_RET0;
 			} else if (tim > (expir - warntime) && !quietlog) {
@@ -857,6 +923,8 @@
 				GSendInt( V_MSG_ERR );
 				GSendStr( "Your account has expired;"
 				          " please contact your system administrator" );
+				/* Log the failed login attempt */
+				log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 				GSendInt( V_FAIL );
 				LC_RET0;
 			}
@@ -916,6 +984,8 @@
 			close( fd );
 		}
 		GSendStr( "Logins are not allowed at the moment.\nTry again later" );
+		/* Log the failed login attempt */
+		log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 		GSendInt( V_FAIL );
 		LC_RET0;
 	}
@@ -926,6 +996,8 @@
 		PrepErrorGreet();
 		GSendInt( V_MSG_ERR );
 		GSendStr( "You are not allowed to login at the moment" );
+		/* Log the failed login attempt */
+		log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 		GSendInt( V_FAIL );
 		LC_RET0;
 	}
@@ -937,6 +1009,8 @@
 			Debug( "shell not in /etc/shells\n" );
 			endusershell();
 			V_RET_FAIL( "Your login shell is not listed in /etc/shells" );
+			/* Log the failed login attempt */
+			log_to_audit_system (curuser, td->remoteHost, td->name, AU_FAILED);
 		}
 		if (!strcmp( s, p->pw_shell )) {
 			endusershell();
@@ -1359,6 +1433,9 @@
 # define D_LOGIN_SETGROUP 0
 #endif /* USE_PAM */
 
+	/* Login succeeded */
+	log_to_audit_system (curuser, td->remoteHost, td->name, AU_SUCCESS);
+
 	removeAuth = 1;
 	chownCtrl( &td->ctrl, curuid );
 	endpwent();
diff -Nur kdebase-3.5.8.orig/kdm/backend/Makefile.am kdebase-3.5.8/kdm/backend/Makefile.am
--- kdebase-3.5.8.orig/kdm/backend/Makefile.am	2007-11-21 09:53:07.000000000 +0200
+++ kdebase-3.5.8/kdm/backend/Makefile.am	2007-11-21 10:00:33.000000000 +0200
@@ -4,7 +4,7 @@
 LDFLAGS = $(USER_LDFLAGS) $(X_LDFLAGS) $(X_RPATH) $(KRB4_RPATH) $(KRB5_RPATH)
 LDADD = $(LIB_X11) -lXau $(LIBXDMCP) $(PASSWDLIBS) $(LIBSHADOW) $(LIBGEN) \
     $(LIB_LIBS) $(KRB4_LIBS) $(KRB5_LIBS) $(DBUS_LIBS) $(LIBSOCKET) $(LIBRESOLV) \
-    $(LIBUCB) $(LIBUTIL) $(LIBPOSIX4)
+    $(LIBUCB) $(LIBUTIL) $(LIBPOSIX4) -laudit
 
 bin_PROGRAMS = kdm
 kdm_SOURCES = \
diff -Nur kdebase-3.5.8.orig/kdm/configure.in.in kdebase-3.5.8/kdm/configure.in.in
--- kdebase-3.5.8.orig/kdm/configure.in.in	2007-11-21 09:53:07.000000000 +0200
+++ kdebase-3.5.8/kdm/configure.in.in	2007-11-21 10:00:10.000000000 +0200
@@ -288,3 +288,27 @@
   AC_SUBST(DBUS_LIBS)
 
 dnl AC_OUTPUT(kdm/kfrontend/sessions/kde.desktop)
+
+
+AC_ARG_WITH(libaudit,
+  [  --with-libaudit=[auto/yes/no]  Add Linux audit support [default=auto]],,
+  with_libaudit=auto)
+
+# Check for Linux auditing API
+#
+# libaudit detection
+if test x$with_libaudit = xno ; then
+    have_libaudit=no;
+else
+    # See if we have audit daemon library
+    AC_CHECK_LIB(audit, audit_log_user_message,
+                 have_libaudit=yes, have_libaudit=no)
+fi
+
+AM_CONDITIONAL(HAVE_LIBAUDIT, test x$have_libaudit = xyes)
+
+if test x$have_libaudit = xyes ; then
+    EXTRA_DAEMON_LIBS="$EXTRA_DAEMON_LIBS -laudit"
+    AC_DEFINE(HAVE_LIBAUDIT,1,[linux audit support])
+fi
+