5

So, I need to know when my account in ubuntu is accessed. Is there any command that will show me the Exact Time when that happened. I need this because I suspect someone is remotely controlling my computer, and changing things.

0

2 Answers 2

8

last command to the rescue

The last command shows by a given user name or all user names:

$ last rick
rick     tty7         :0               Wed Apr 24 16:25    gone - no logout
rick     tty8         :1               Wed Apr 24 16:24 - down   (00:00)
rick     tty7         :0               Tue Apr 23 20:12 - down   (20:06)
rick     tty7         :0               Tue Apr 23 18:30 - crash  (01:42)
  (...SNIP...)
rick     tty7         :0               Tue Apr  2 16:52 - down   (00:31)
rick     tty7         :0               Tue Apr  2 03:14 - crash  (13:37)

By default it only shows history for the current month. If you need to go further back in history than one month, you can read the /var/log/wtmp.1 file with the last command.

last -f wtmp.1 rick will show the previous month's history of logins for user rick:

$ last -f /var/log/wtmp.1 rick
rick     tty7         :0               Sun Mar 31 16:53    gone - no logout
rick     tty7         :0               Sat Mar 30 19:18 - down   (13:20)
  (...SNIP...)
rick     tty7         :0               Fri Mar  1 20:55 - down   (11:55)

wtmp.1 begins Fri Mar  1 18:23:28 2019

Security is hardened such that normal users can't write or delete the file:

$ ll /var/log/wtmp.1
-rw-rw-r-- 1 root utmp 107520 Mar 31 16:53 /var/log/wtmp.1

Console only logins

The console uses the login command which records data to /var/log/lastlog:

$ ll /var/log/lastlog
-rw-rw-r-- 1 root utmp 292292 Apr 24 16:22 /var/log/lastlog

The lastlog file though cannot be tampered with so easily when you look at the File Owner and File Group above. "Normal" users just have read access. It's a binary file though so you can't just cat it and get meaningful information. Use this command instead:

$ lastlog
Username         Port     From             Latest
root                                       **Never logged in**
daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**
  (...SNIP...)
usbmux                                     **Never logged in**
rick             tty1                      Wed Nov 28 04:19:53 -0700 2018
vnstat                                     **Never logged in**

It's interesting to see all the different user IDs that could log in but never have and never should. I was surprised I haven't logged into the console / terminal since November last year.

4

This would be shown in /var/log/auth.log if the 'person' controlling your system remotely is not smart enough to clean up the logs. You might be able to see login data by using:

sudo cat /var/log/auth.log | grep USERNAME

(where USERNAME is your user).

Beyond this, however, if there's nothing in this log, and you really do think you're being remote-controlled, I'd suggest clean-installing your system and starting from scratch with different passwords and better hardening your system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .