0

I my office we are using Ubuntu Server 12.04. I have installed SSH server in it for clients to access through PuTTY.

Now I need to track the users login details like IP address, hostname and date of login.

Is that possible to trace those information, and if so how?

2 Answers 2

0

you should already have all those information in the sshd log file or even in /var/log/syslog file.
What you can try to see what kind of log are generated by sshd find the log use by it reading the config file in /etc/ssh/sshd.conf (not sure of file name) once you find which file populate by the daemon.
Use the command tail -f /path/to/log/file and attempt a logging you should see lots of info about login attempt.

0

You can use the last command to view previous logins - this:

last -adw

will generate lines like this:

USERNAME  pts/0        Wed Jan 29 10:18   still logged in    192.168.1.?
USERNAME  pts/0        Wed Jan 29 10:06 - 10:07  (00:00)     192.168.1.?

Where, USERNAME, access point, date and time, and IP addresses are displayed. This should work as long as whoever logged in did not wipe these logs:

/var/log/wtmp
/var/log/btmp

But they would need the root password to do that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.