So, I need to know when my account in ubuntu is accessed. Is there any command that will show me the Exact Time when that happened. I need this because I suspect someone is remotely controlling my computer, and changing things.
last command to the rescue
last command shows by a given user name or all user names:
$ last rick rick tty7 :0 Wed Apr 24 16:25 gone - no logout rick tty8 :1 Wed Apr 24 16:24 - down (00:00) rick tty7 :0 Tue Apr 23 20:12 - down (20:06) rick tty7 :0 Tue Apr 23 18:30 - crash (01:42) (...SNIP...) rick tty7 :0 Tue Apr 2 16:52 - down (00:31) rick tty7 :0 Tue Apr 2 03:14 - crash (13:37)
By default it only shows history for the current month. If you need to go further back in history than one month, you can read the
/var/log/wtmp.1 file with the
last -f wtmp.1 rick will show the previous month's history of logins for user
$ last -f /var/log/wtmp.1 rick rick tty7 :0 Sun Mar 31 16:53 gone - no logout rick tty7 :0 Sat Mar 30 19:18 - down (13:20) (...SNIP...) rick tty7 :0 Fri Mar 1 20:55 - down (11:55) wtmp.1 begins Fri Mar 1 18:23:28 2019
Security is hardened such that normal users can't write or delete the file:
$ ll /var/log/wtmp.1 -rw-rw-r-- 1 root utmp 107520 Mar 31 16:53 /var/log/wtmp.1
Console only logins
The console uses the
login command which records data to
$ ll /var/log/lastlog -rw-rw-r-- 1 root utmp 292292 Apr 24 16:22 /var/log/lastlog
lastlog file though cannot be tampered with so easily when you look at the File Owner and File Group above. "Normal" users just have read access. It's a binary file though so you can't just
cat it and get meaningful information. Use this command instead:
$ lastlog Username Port From Latest root **Never logged in** daemon **Never logged in** bin **Never logged in** sys **Never logged in** (...SNIP...) usbmux **Never logged in** rick tty1 Wed Nov 28 04:19:53 -0700 2018 vnstat **Never logged in**
It's interesting to see all the different user IDs that could log in but never have and never should. I was surprised I haven't logged into the console / terminal since November last year.
This would be shown in
/var/log/auth.log if the 'person' controlling your system remotely is not smart enough to clean up the logs. You might be able to see login data by using:
sudo cat /var/log/auth.log | grep USERNAME
USERNAME is your user).
Beyond this, however, if there's nothing in this log, and you really do think you're being remote-controlled, I'd suggest clean-installing your system and starting from scratch with different passwords and better hardening your system.