Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I my office we are using Ubuntu Server 12.04. I have installed SSH server in it for clients to access through Putty.
Now I need to track the users login details like IP address, hostname and date of login.
Is that possible to trace those information, and if so how ?

share|improve this question
add comment

2 Answers 2

you should already have all those information in the sshd log file or even in /var/log/syslog file.
What you can try to see what kind of log are generated by sshd find the log use by it reading the config file in /etc/ssh/sshd.conf (not sure of file name) once you find which file populate by the daemon.
Use the command tail -f /path/to/log/file and attempt a logging you should see lots of info about login attempt.

share|improve this answer
add comment

You can use the last command to view previous logins - this:

last -adw

will generate lines like this:

USERNAME  pts/0        Wed Jan 29 10:18   still logged in    192.168.1.?
USERNAME  pts/0        Wed Jan 29 10:06 - 10:07  (00:00)     192.168.1.?

Where, USERNAME, access point, date and time, and IP addresses are displayed. This should work as long as whoever logged in did not wipe these logs:

/var/log/wtmp
/var/log/btmp

But they would need the root password to do that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.