Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to see who has logged into a system via SSH, from which IP and when.

The system is Ubuntu 10.04 LTS , so there is no /var/log/secure

How can this be done?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

check in /var/log/auth.log
There is no /var/log/secure in Ubuntu -- afaik (that was RedHat?).

Also, remember log rotation (so, lookup the auth.log.N.gz files too).

more ref.

  1. LinuxLogFiles at Ubuntu Help pages describe auth.log -- has a lot more details
  2. 20 Linux Log Files that are Located under /var/log Directory.
share|improve this answer

The command "last" will show you login history.

share|improve this answer

Check out lastlog :

petrus@host:~$ lastlog 
Utilisateur      Port     Venant de        Dernière
root                                       **Jamais connecté**
daemon                                     **Jamais connecté**
bin                                        **Jamais connecté**
sys                                        **Jamais connecté**
petrus           pts/0    2a01:e34:ee8c:18 dim. juin 17 20:06:14 +0200 2012
share|improve this answer
    
Sorry, system is in french, but it says: "User", "From", and "Last login". "Jamais connecté" means "never logged in". –  petrus Jun 17 '12 at 18:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.