So, I need to know when my account in ubuntu is accessed. Is there any command that will show me the Exact Time when that happened. I need this because I suspect someone is remotely controlling my computer, and changing things.
2 Answers
last
command to the rescue
The last
command shows by a given user name or all user names:
$ last rick
rick tty7 :0 Wed Apr 24 16:25 gone - no logout
rick tty8 :1 Wed Apr 24 16:24 - down (00:00)
rick tty7 :0 Tue Apr 23 20:12 - down (20:06)
rick tty7 :0 Tue Apr 23 18:30 - crash (01:42)
(...SNIP...)
rick tty7 :0 Tue Apr 2 16:52 - down (00:31)
rick tty7 :0 Tue Apr 2 03:14 - crash (13:37)
By default it only shows history for the current month. If you need to go further back in history than one month, you can read the /var/log/wtmp.1
file with the last
command.
last -f wtmp.1 rick
will show the previous month's history of logins for user rick
:
$ last -f /var/log/wtmp.1 rick
rick tty7 :0 Sun Mar 31 16:53 gone - no logout
rick tty7 :0 Sat Mar 30 19:18 - down (13:20)
(...SNIP...)
rick tty7 :0 Fri Mar 1 20:55 - down (11:55)
wtmp.1 begins Fri Mar 1 18:23:28 2019
Security is hardened such that normal users can't write or delete the file:
$ ll /var/log/wtmp.1
-rw-rw-r-- 1 root utmp 107520 Mar 31 16:53 /var/log/wtmp.1
Console only logins
The console uses the login
command which records data to /var/log/lastlog
:
$ ll /var/log/lastlog
-rw-rw-r-- 1 root utmp 292292 Apr 24 16:22 /var/log/lastlog
The lastlog
file though cannot be tampered with so easily when you look at the File Owner and File Group above. "Normal" users just have read access. It's a binary file though so you can't just cat
it and get meaningful information. Use this command instead:
$ lastlog
Username Port From Latest
root **Never logged in**
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
(...SNIP...)
usbmux **Never logged in**
rick tty1 Wed Nov 28 04:19:53 -0700 2018
vnstat **Never logged in**
It's interesting to see all the different user IDs that could log in but never have and never should. I was surprised I haven't logged into the console / terminal since November last year.
This would be shown in /var/log/auth.log
if the 'person' controlling your system remotely is not smart enough to clean up the logs. You might be able to see login data by using:
sudo cat /var/log/auth.log | grep USERNAME
(where USERNAME
is your user).
Beyond this, however, if there's nothing in this log, and you really do think you're being remote-controlled, I'd suggest clean-installing your system and starting from scratch with different passwords and better hardening your system.