I am using Ubuntu. Is there a good system that can do this?
-
3Surprised about the negative modding. Seems like a fair question, albeit one that might deserve a RTFM answer.– BuildTheRobotsJan 14, 2010 at 21:50
-
RTFM answers are discouraged. But it's hard to tell what the OP is looking for anyway.– womble ♦Jan 14, 2010 at 22:32
Add a comment
|
5 Answers
if you mean people connecting via ssh, then try sudo last.
You could use something like LogWatch to email you updates.
-
2We use LogWatch to sends us an email of all IP addresses that attempt to ssh to the machine. The analysis of said logs has recently caused us to move all our ssh to a non-standard port just to stop the random crack attempts, even though they were never successful. Jan 14, 2010 at 21:01
-
1@Catherine MacInnes: fail2ban is a lovely little program that will watch your logs for brute force attempts and then tell iptables to block the connection. www.fail2ban.org. Should be what you're looking for (although a non standard port does cut out 99% of none targeted attacks) Jan 14, 2010 at 21:52
What services do you want to monitor?
Most services already have logging capabilities. If you want to monitor some services that lacks a logging facility then you can add an iptables rule that will log any connection attempt to your system.
# Log syn packets
iptables --append INPUT --proto tcp --dport 0:65535 --syn --jump LOG \
--log-level 6 --log-prefix "IPTBLS TCP-LOCAL: "
answered Jan 14, 2010 at 21:14
looking at the "/var/log/messages" and all other log file frequently considered a good habit those who sits on open system.So start doing it from now... you never know when you get compromised :)
The following will show you ssh logins and attempted logins:
sudo cat /var/log/auth.log | grep 'sshd'
Though as Catherine MacInnes suggested, using logwatch makes life easier.
If you mean when people ssh into your machine, you can find that information in the /var/log/auth.log file
answered Jan 25, 2010 at 16:16
