Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It seems someone logged into my dev server with root password and did a whole bunch of destruction. How do I check the recent logins and their IP address on Cent OS ?


share|improve this question

migrated from May 26 '11 at 1:38

This question came from our site for professional and enthusiast programmers.

it could be useful to have a look on the following links and check if you react correctly on the issue:, – Andrey Sapegin May 4 '15 at 14:41

lastlog(8) will report the most recent information from the /var/log/lastlog facility, if you have pam_lastlog(8) configured.

aulastlog(8) will make a similar report, but from the audit logs in /var/log/audit/audit.log. (Recommended, as auditd(8) records are harder to tamper with than syslog(3) records.)

ausearch -c sshd will search your audit logs for reports from the sshd process.

last(8) will search through /var/log/wtmp for the most recent logins. lastb(8) will show bad login attempts.

/root/.bash_history might contain some details, assuming the goober who fiddled with your system was incompetent enough to not remove it before logging out.

Make sure you check ~/.ssh/authorized_keys files for all users on the system, check crontabs to make sure no new ports are scheduled to be opened at some point in the future, etc. While you really should just rebuild the machine from scratch, it wouldn't hurt to take the time to learn what the attacker did.

Note that all logs stored on the local machine are suspect; the only logs you can realistically trust are forwarded to another machine that wasn't compromised. Perhaps it would be worth investigating centralized log handling via rsyslog(8) or auditd(8) remote machine handling.

share|improve this answer
grep sshd /var/log/audit/audit.log
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.