Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I all, I have a linux Server (Ubuntu) where some user can be connect to by ssh. Is possible to know who was connected to the server? A sort of list of login by ssh of the past day. Is possible to retrieve?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

who will show you who is currently connected.
w will show you who is curretly connected, plus what command they're running.
last will show you all users logged in/out since /var/log/wtmp was last rolled.

The contents of /var/log/auth.log and/or /var/log/secure may also be useful, but the commands above will probably get you what you need to know

share|improve this answer
    
I don't want who is connect in that moment but who connected in last days. I'll see this file –  Alessandro Minoccheri Feb 26 '13 at 17:11
    
I don't have /var/log/auth.log /var/log/wtmp and /var/log/secure no files.. :( –  Alessandro Minoccheri Feb 26 '13 at 17:14
add comment

I don't know if this'll help but I came across the last command recently. It shows:

  • User name
  • Tty device number
  • Login date and time
  • Logout time
  • Total working time

For Example: Example

Also, If I'm not mistaken, remote login attempts are stored in the /var/log/secure logs as well.

Hope this Helps..

share|improve this answer
    
I don't have file or folder in var/log/secure. Secure isn't exist –  Alessandro Minoccheri Feb 27 '13 at 7:24
    
Can you try the following --> grep -ir ssh /var/log/* and grep -ir security /var/log/* –  i.h4d35 Feb 28 '13 at 5:00
    
Nothing return to me –  Alessandro Minoccheri Feb 28 '13 at 11:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.