 |
 |
SSH history
|
|
|
|
|
Mac Elite
Join Date: Sep 2000
Location: Edmond, OK USA
Status:
Offline
|
|
How can I see an audit of how and when users have logged into my machine? I would like to just verify that noone has connected when I didn't suspect it.
|
|
|
| |
|
|
|
|
|
|
|
Forum Regular
Join Date: Nov 2000
Location: Seattle, Wa, USA
Status:
Offline
|
|
in the terminal type 'last'
does that help?
|
|
|
| |
|
|
|
|
|
|
|
Mac Elite
Join Date: Sep 2000
Location: Edmond, OK USA
Status:
Offline
|
|
</font><blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">quote:</font><hr /><font size="1" face="Geneva, Verdana, Arial, sans-serif">Originally posted by johann:
<strong>in the terminal type 'last'
does that help?</strong></font><hr /></blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">Yes, that's very nice. Does this data come from a file somewhere? Some of the domain names are too long and I would like to see all of them.
Nevermind, I guess it uses /var/log/wtmp, but I can't make much sense of it.
<small>[ 05-30-2002, 03:58 PM: Message edited by: absmiths ]</small>
|
|
|
| |
|
|
|
|
|
|
|
Mac Elite
Join Date: May 1999
Location: San Jose, CA
Status:
Offline
|
|
</font><blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">quote:</font><hr /><font size="1" face="Geneva, Verdana, Arial, sans-serif">Originally posted by absmiths:
<strong> </font><blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">quote:</font><hr /><font size="1" face="Geneva, Verdana, Arial, sans-serif">Originally posted by johann:
<strong>in the terminal type 'last'
does that help?</strong></font><hr /></blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">Yes, that's very nice. Does this data come from a file somewhere? Some of the domain names are too long and I would like to see all of them.
Nevermind, I guess it uses /var/log/wtmp, but I can't make much sense of it.</strong></font><hr /></blockquote><font size="1" face="Geneva, Verdana, Arial, sans-serif">/var/log/wtmp is indeed the file, but you're not supposed to be able to make sense or it. If it were a plain text file (for example, in the same format as the output of the 'last' command) it would be too easy for a hacker to edit the file and remove all trace of his login.
|
|
Gods don't kill people - people with Gods kill people.
|
| |
|
|
|
|
|
|
|
Dedicated MacNNer
Join Date: Oct 2001
Location: Baltimore, MD, US
Status:
Offline
|
|
It's not that hard anyway. The format of wtmp is well-documented, and it's pretty easy to remove records. Since the records are fixed-length, you can even use the dd command to edit out parts you want to hide, so you don't have to write a program.
|
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
 
|
|
|
Forum Rules
|
|
|
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
|
HTML code is Off
|
|
|
|
|
|
|
|
|
|
|
|
Top