LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 06-07-2005, 02:58 PM   #1
gtwilliams
LQ Newbie
 
Registered: Jun 2005
Distribution: ubuntu - hoary hedgehog
Posts: 13

Rep: Reputation: 0
Question How do i monitor SSH logins?


Hey,
How do i monitor SSH logins real time, instead of reading logs ?

1) How do i read the logs, where are they
2) Is there software that notifies me when someone has logged in and what he/she is doing? Is there a way to communicate with the users when they log in?

Ubuntu - Hoary Hedgehog
 
Old 06-07-2005, 03:28 PM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
welcome to LQ!!! to see the logs in "real time":
Code:
tail -f /var/log/messages
to see who is logged and what they are doing:
Code:
w
to send a message to another user's TTY (example):
Code:
echo "I can see what you are doing!" > /dev/pts/1
to actually "talk" with a user:
Code:
talk user
http://www.die.net/doc/linux/man/man1/tail.1.html

http://www.die.net/doc/linux/man/man1/w.1.html

http://www.die.net/doc/linux/man/man1/echo.1.html

http://www.die.net/doc/linux/man/man1/talk.1.html


just my ... good luck...


Last edited by win32sux; 06-07-2005 at 03:31 PM.
 
Old 06-07-2005, 03:31 PM   #3
int0x80
Member
 
Registered: Sep 2002
Location: Cincinnati
Distribution: Debian GNU/Linux
Posts: 310

Rep: Reputation: 31
There is also an application called logcheck that can email you with various system notifications, including user logins.
 
Old 06-08-2005, 07:07 PM   #4
gtwilliams
LQ Newbie
 
Registered: Jun 2005
Distribution: ubuntu - hoary hedgehog
Posts: 13

Original Poster
Rep: Reputation: 0
Is there a way to list the last X number of commands from a user?

Grant
 
Old 06-08-2005, 09:35 PM   #5
lowpro2k3
Member
 
Registered: Oct 2003
Location: Canada
Distribution: Slackware
Posts: 340

Rep: Reputation: 30
Quote:
Originally posted by gtwilliams
Is there a way to list the last X number of commands from a user?

Grant
Make sure they can't modify their ~/.bash_history file on their own (not sure if they are required to have write access to their own .bash_history, anyone??) and run tail commands periodically on the ~/.bash_history file. Although I dont see what your trying to accomplish... If you want to 'stop' them from running commands its harder than that.

It would be more secure to limit what resources they have access to. I feel sorry for colleges/uni's who need to provide a development environment in *nix to the comp sci students. If you give anyone a C compiler, or an Assembler, heck even a Perl interpreter, your basically giving up root access. But what can schools do, these students (me) need to be able develop remotely. Theres just a mutual respect I follow at school and would hope others would too. They give us the development tools we need with the huge possiblity of getting easily rooted. But since they give us the tools to do our 'real' work, nobody does (or at least not many know how in the first place ).
 
Old 06-08-2005, 10:43 PM   #6
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Quote:
Originally posted by gtwilliams
Is there a way to list the last X number of commands from a user?
Might also want to check out psacct for more verbose logging of user commands that isn't as susceptible to 'unsetting' like bash histories.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Restricting SSH logins. bullium Linux - Security 3 05-10-2005 01:15 AM
Massive SSH Logins zeeshanhayat Linux - Security 1 03-08-2005 12:49 PM
ssh logins not allowed - keyboard something student04 Linux - Networking 10 01-04-2005 04:03 AM
Need help using Webmin to tell SSH to allow logins Xolo Linux - Security 9 11-22-2004 03:57 PM
control / monitor dhcp logins pasta_fetuccini Linux - General 1 04-17-2004 12:22 AM


All times are GMT -5. The time now is 07:26 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration