Results 1 to 5 of 5
  1. #1
    Join Date
    Jul 2003
    rowland hts, california

    Logs where SSH LOgins are stored?

    Are there any logs where SSH logins are logged?

    I have a perp whom accessed the demo account of a reseller and started doing really stupid things..

  2. #2
    Join Date
    Mar 2003
    California USA
    /var/log/messages or /var/log/secure
    Steven Ciaburri | Proactive Linux Server Management -
    Managed Servers (AS62710), Server Management, and Security Auditing.

  3. #3
    you could try :

    last -xxx << xxx number of previous log-ins you want to view; IF thats what you are looking for.

  4. #4
    You can check by doing a
    cat /etc/ssh/sshd_config | grep SyslogFacility
    the default facility is Auth. Then look in your /etc/syslog.conf for an auth.* /var/log/secure or something like that.

    if its not there just add auth.* /var/log/auth.log
    in your syslog.conf and restart syslog.

  5. #5
    If you want to see what the guy did, you can take a look at $HOME/.bash_history is your are using bash, or just $HOME/.history for tcsh.
    ::. : Dedicated Servers : Virtual Machine Servers .::
    ::. Industry-Leading Remote Server Management .::
    ::. Automatic OS Re-image : Instant Server Reboot : Remote Serial Console .::
    ::. Over 20 OSes to choose from : Install a new OS every day .::

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts