1

I my office we are using Ubuntu Server 12.04. I have installed SSH server in it for clients to access through PuTTY.

Now I need to track the users login details like IP address, hostname and date of login.

Is that possible to trace those information, and if so how?

2 Answers 2

1

You can use the last command to view previous logins - this:

last -adw

will generate lines like this:

USERNAME  pts/0        Wed Jan 29 10:18   still logged in    192.168.1.?
USERNAME  pts/0        Wed Jan 29 10:06 - 10:07  (00:00)     192.168.1.?

Where, USERNAME, access point, date and time, and IP addresses are displayed. This should work as long as whoever logged in did not wipe these logs:

/var/log/wtmp
/var/log/btmp

But they would need the root password to do that.

0

you should already have all those information in the sshd log file or even in /var/log/syslog file.
What you can try to see what kind of log are generated by sshd find the log use by it reading the config file in /etc/ssh/sshd.conf (not sure of file name) once you find which file populate by the daemon.
Use the command tail -f /path/to/log/file and attempt a logging you should see lots of info about login attempt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .