Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?
I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.
I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.
#!/bin/bash
grep users /etc/group | awk -F ":" '{print $4}' | sed 's/,/\
/g' > list
for fn in `cat list`; do lastlog -u $fn | grep Never; done
rm list
echo
lastlog -b 30 | grep -iv Never | awk '{if (NR!=1) {print $1" last logged in on "$5" "$6" at "$7}}'
In your case, you dont want to filter out anything like i am; so wouldn't a simple
lastlog -b 30
(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
last
didn't give you?