Hi I run sshd on port 443 at home and my brother in law connected to grab some files via scp. I noticed that he didn't show up when typing 'who' or 'w'.

I then ssh'ed to one of my work machines at the office and then ssh'ed back to my home box and ran 'who' and could see myself. So why couldn't I see him? Very worrying!

The only way I could tell he had connected was that it was in /var/log/messages and the fact that 'netstat -atn |grep 443' was showing an established connection.

Anyone got any ideas because I'd like to know if people are on my system.

Hi,

who (and w) show peolple that are actually logged on to your system. The person that scp's is not logged on, that's why it does not show up in who.

As you already noticed the info about who is doing what (in this case scp-ing into your box) is logged in /var/log/messages.

Hope this clears things up.

Yeah I was wondering if that was the case, I just thought it was odd that he knew the listing of the directories. I expected him to ssh to browse for the files he wants and then scp them. I guess he must have been using some kind of windows scp client that allows you to browse the directories because 'last' never showed him having logged on.

Thanks