View logs of past logins to the server

Question

I am using a server running the Debian operating system. Is there a way i can check who logged in to the server, i mean the past logins . I would like to do this to monitor the security on the server. Is this information stored somewhere ?

Thank You

Answer 1

The /var/log/utmp and /var/log/wtmp files store details of logins and logouts. They are described in the utmp man page.

You can use the last command (in the Debian sysvinit-utils package) to display the logins:

# last
me       pts/0        hostname1        Mon Dec 14 15:03   still logged in
someone  pts/0        hostname2        Mon Dec 14 11:12 - 12:20  (01:08)

wtmp begins Tue Dec  1 15:18:32 2009

Answer 2

User logins are stored in /var/log/auth.log by default on debian systems

Answer 3

/var/log/auth.log contains authentication information, including logins. Try 'cat /var/log/auth.log | grep ssh' for SSH logins.

Answer 4

Use the "last" command, which shows a list of the last logged in users:

last | head -n 10

man last

for more information :)