I all, I have a linux Server (Ubuntu) where some user can be connect to by ssh. Is possible to know who was connected to the server? A sort of list of login by ssh of the past day. Is possible to retrieve?
who will show you who is currently connected.
w will show you who is curretly connected, plus what command they're running.
last will show you all users logged in/out since
/var/log/wtmp was last rolled.
The contents of
/var/log/secure may also be useful, but the commands above will probably get you what you need to know
I don't know if this'll help but I came across the last command recently. It shows:
- User name
- Tty device number
- Login date and time
- Logout time
- Total working time
Also, If I'm not mistaken, remote login attempts are stored in the /var/log/secure logs as well.
Hope this Helps..