0

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?

I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.

1
  • 1
    What are you looking for that last didn't give you? Mar 14, 2014 at 15:49

1 Answer 1

0

I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.

#!/bin/bash
grep users /etc/group | awk -F ":" '{print $4}' | sed 's/,/\
/g' > list
for fn in `cat list`; do lastlog -u $fn | grep Never; done
rm list
echo
lastlog -b 30 | grep -iv Never | awk '{if (NR!=1) {print $1" last logged in on "$5" "$6" at "$7}}'

In your case, you dont want to filter out anything like i am; so wouldn't a simple

lastlog -b 30

(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.

daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .