List chroot users

zzyzx · 08-18-2008, 05:20 PM

This may be a simple one, but I haven't been able to track down an answer anywhere. I have a Slackware box which allows remote users to log in via sftp. All users are chroot'd to their home directory.

How can I list users who are currently logged in or have logged in via sftp?

Running "who", etc just lists users logged in via ssh or locally. /var/log/utemp and /var/log/wtemp never list anyone logged in under sftp and chrooted. Any suggestions?

Thanks.

trickykid · 08-18-2008, 10:23 PM

vsftpd usually logs to it's own configured log in /var/log like /var/log/vsftpd.log. Check your configuration, if it's not configured, it's probably by default logging to messages or syslog, in which you may want to change. I'm not sure of any specific commands for vsftpd but you could probably write a script to parse the logs to find out who's logged in and at what times, etc.

Edit: Didn't realize you only said sftpd and not vsftp. What ftpd daemon are you specifically running?

zzyzx · 08-19-2008, 11:49 AM

Thanks for the reply. I'm running the sftp connections through ssh (sftp-server).